`gather_metadata` does not preserve tree of dependencies

[shs96c]

When generating a Cyclone DX SBOM, it is desirable to model the graph of dependencies via the dependencies attribute. The required data is not preserved by our existing providers.