Make CBOM actually document dependencies

[baentsch]

As per #2041 (comment)

Suggest to also take a look at (improving with proper reference to liboqs CBOM?) https://github.com/open-quantum-safe/oqs-provider/blob/main/sbom.cdx.json

Also good may be an explanation as to the difference between SBOM and CBOM.