feat: improve PDM reports reading lock and only report production dependencies

[JCHacking]

Describe the solution you'd like

I am considering migrating my poetry projects to pdm to comply with PEP 518 and PEP 631 and be faster (that's what the benchmarks I have seen say).

One obstacle is the way to generate the SBOM, since with poetry it reads the lock and only reports the production dependencies. This does not happen with PDM since its only support is reading a venv.

[jkowalleck]

duplicates #604
see also previous attempts: #603

feel free to contribute this feature.