fix: match JS client empty SBOM structure in CycloneDX output

When all dependencies are filtered out, the Java client now produces
the same SBOM structure as the JS client: "components": [] is always
present and "dependencies": [] is empty (no orphan root dep entry).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/sbom/CycloneDXSbom.java

@@ -230,6 +230,9 @@ private Sbom removeIgnoredDepsFromSbom(List<String> refsToIgnore) {
                 d.setDependencies(filteredDeps);
               }
             });
+    if (bom.getComponents().isEmpty()) {
+      bom.setDependencies(new ArrayList<>());
+    }
     return this;
   }
 
@@ -302,12 +305,26 @@ public Sbom addDependency(PackageURL sourceRef, PackageURL targetRef, String s)
   public String getAsJsonString() {
     try {
       var jsonString = BomGeneratorFactory.createJson(VERSION, bom).toJsonString();
+      jsonString = ensureComponentsField(jsonString);
       if (debugLoggingIsNeeded()) {
         log.info("Generated Sbom Json:" + System.lineSeparator() + jsonString);
       }
       return jsonString;
     } catch (GeneratorException e) {
-      throw new RuntimeException("Unable to genenerate JSON from SBOM", e);
+      throw new RuntimeException("Unable to generate JSON from SBOM", e);
+    }
+  }
+
+  private String ensureComponentsField(String json) {
+    try {
+      var mapper = new com.fasterxml.jackson.databind.ObjectMapper();
+      var root = (com.fasterxml.jackson.databind.node.ObjectNode) mapper.readTree(json);
+      if (!root.has("components")) {
+        root.set("components", mapper.createArrayNode());
+      }
+      return mapper.writeValueAsString(root);
+    } catch (Exception e) {
+      return json;
     }
   }
 

src/test/resources/tst_manifests/golang/go_mod_with_all_ignore/expected_sbom_component_analysis.json

@@ -12,10 +12,6 @@
       "purl": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0"
     }
   },
-  "dependencies": [
-    {
-      "ref": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0",
-      "dependsOn": [ ]
-    }
-  ]
+  "components": [ ],
+  "dependencies": [ ]
 }