Duplicate results

[Feelemoon]

When parsing a hierarchical CycloneDX SBOM, there is the possibility of duplicate references to some components. These are evaluated (?) and reported multiple times, without a way to differentiate them (or trace the to the originating component).

The result represented by osv-scanner should:

• not contain duplicate entries, and
• allow to see, where the faulty component originates (ie. present a component tree like npm audit or cargo audit)

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions]

Automatically closing stale issue