Include transitive dependencies in generated spdx bom

[patflynn]

When generating an SPDX sbom for a Maven project, I suspect sbom users will want the complete inventory of all dependencies of that project to obtain complete coverage of the contents. It would be nice if this plugin would include them in the output by default, or else provide an option to enable it.

Thanks!

[goneall]

to implement - we should include the transitive dependencies, walking through graph of POM dependencies and create relationships between the dependencies and their dependencies.