bug(sbom): multiple Results for one package with root relationship for sbom mode

[DmitriyLewen]

Description

For sbom mode Trivy creates 2 Results for one Application (if Package has Root relationship)
e.g.:

➜  ./trivy -q rootfs -f cyclonedx -o report.cdx.json ./pkg/dependency/parser/golang/binary/testdata/test.elf
➜  ./trivy -q sbom -f json --list-all-pkgs  ./report.cdx.json | grep Target -A 2                            
      "Target": "",
      "Class": "lang-pkgs",
      "Type": "gobinary",
--
      "Target": "test.elf",
      "Class": "lang-pkgs",
      "Type": "gobinary",

Discussed in #7169