fix: resolve SBOM dependency tree root from metadata (#5745)

[faystmax]

Fixes #5745.

The Dependency Trees view previously used dependencies[0] as its root, so reordering CycloneDX dependency records could display a library's subtree instead of the application's dependencies.

Pass metadata.component["bom-ref"] from the SBOM response to the normalizer and resolve the root by its exact reference before formatting its label. When the root cannot be resolved, show the existing SBOM empty-state message instead of selecting an unrelated record. Handle omitted dependency lists safely and keep filtering functional when the initial filter produces no tree.

Regression tests cover root positions, full-reference matching, input preservation, missing metadata/root records, empty or omitted dependency lists, propagation through the fetched SBOM response, and clearing an initially unmatched filter.