make sure correct dependency fields (groupId, artifactId, version) are acquired

[randomicecube]

In some cases, we're capturing wrong fields (e.g., classifier instead of version): see chains-project/sbom.exe#317 (comment)