fix(sbom): dedupe per-node dependsOn / relationships - #9311

Summary

Closes the per-node duplication gap left by #7992.

A node can have multiple outgoing edges resolving to the same name@version — typically when a package declares both a direct dependency and an npm alias to the same package, e.g.:

{
  "dependencies": {
    "lodash": "^4.17.21",
    "lodash-aliased": "npm:lodash@^4.17.21"
  }
}

toCyclonedxDependency and the SPDX relationship loop both map each edge through name@version ID generation without deduplicating, so the per-node dependsOn array (CycloneDX) and DEPENDENCY_OF relationships (SPDX) end up with duplicate entries.

CycloneDX 1.5 requires dependsOn items to be unique, so downstream validators (e.g. Dependency Track) reject the SBOM with:

$.dependencies[N].dependsOn: must have only unique items in the array

Changes

• lib/utils/sbom-cyclonedx.js: wrap the dependsOn array in [...new Set(...)] after mapping edges to refs.
• lib/utils/sbom-spdx.js: dedupe per source-node relationships by the (spdxElementId, relatedSpdxElement, relationshipType) triple.
• Test cases added to both test/lib/utils/sbom-cyclonedx.js and test/lib/utils/sbom-spdx.js covering the duplicate-edges-to-same-target scenario, with explicit assertions plus snapshot updates.

Test plan

• node . run test -- test/lib/utils/sbom-cyclonedx.js test/lib/utils/sbom-spdx.js — passes
• 100% coverage on both touched files
• Snapshot diff is purely additive (no existing snapshots changed)
• Schema-validation tests in both files still pass for all snapshots
• Reproduced original issue locally with the alias example, ran patched npm against it, confirmed both CycloneDX dependsOn and SPDX relationships are now deduped

Fixes #9310