TC-1593 CycloneDX SBOM package to Product relationship is missing

[mrizzi]

Description of the PR

• the bug was with skipping adding metadata when dealing with the top level package (i.e. if reflect.DeepEqual(currPkg, toplevel) { continue } because only IsDependency predicates shouldn't be added because already added in

  guac/pkg/ingestor/parser/cyclonedx/parser_cyclonedx.go

  Line 263 in 7534004

  preds.IsDependency = append(preds.IsDependency, common.CreateTopLevelIsDeps(toplevel[0], c.packagePackages, nil, "top-level package GUAC heuristic connecting to each file/package")...)

• added integration test for checking:
  • ALL the expected metadata have been ingested
  • findDependentProduct works for the log4j package reported in TC-1593

Fixes https://issues.redhat.com/browse/TC-1593

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged