Set implied relationships for SBOM components in analysis graph

[JimFuller-RedHat]

SPDX/cyclonedx both allow defining components without any explicit relationship.

In our internal logical database we consider existence of a component, in an SBOM to have an implied Undefined relationship with the DESCRIBES component.

This PR ensures we do the similar in analysis graph.

Example;

Where quarkus-vertx-http component has no defined relationship (in etc/test-data/spdx/quarkus-bom-3.2.11.Final-redhat-00001.json)

>curl -H "Authorization:$(oidc token testing-client --bearer)" "http://localhost:8080/api/v1/analysis/root-component/quarkus-vertx-http"  | jq | bat --language=json

Previously this would list no ancestor component as no explicit dependency was defined in the SBOM thus no relationship was set in analysis graph.

{
      "sbom_id": "01934961-44a7-7b51-8675-2e613fde4334",
      "node_id": "SPDXRef-dfe6bb5c-fc2e-4115-a11e-75947122dbc0",
      "purl": "pkg:maven/io.quarkus/[email protected]?type=jar&repository_url=https://maven.repository.redhat.com/ga/",
      "name": "quarkus-vertx-http-deployment",
      "version": "3.2.11.Final-redhat-00001",
      "published": "2024-05-28 09:26:01+00",
      "document_id": "https://access.redhat.com/security/data/sbom/spdx/quarkus-bom-3.2.11.Final-redhat-00001",
      "product_name": "quarkus-bom",
      "product_version": "3.2.11.Final-redhat-00001",
      "ancestors": []
}

Now we get an ancestor component with relationship key:

{
      "sbom_id": "01934961-44a7-7b51-8675-2e613fde4334",
      "node_id": "SPDXRef-dfe6bb5c-fc2e-4115-a11e-75947122dbc0",
      "purl": "pkg:maven/io.quarkus/[email protected]?type=jar&repository_url=https://maven.repository.redhat.com/ga/",
      "name": "quarkus-vertx-http-deployment",
      "version": "3.2.11.Final-redhat-00001",
      "published": "2024-05-28 09:26:01+00",
      "document_id": "https://access.redhat.com/security/data/sbom/spdx/quarkus-bom-3.2.11.Final-redhat-00001",
      "product_name": "quarkus-bom",
      "product_version": "3.2.11.Final-redhat-00001",
      "ancestors": [
        {
          "sbom_id": "01934961-44a7-7b51-8675-2e613fde4334",
          "node_id": "SPDXRef-2d16b9fa-2dfb-44e5-abab-dc32fcd49628",
          "relationship": "Undefined",
          "purl": "pkg:maven/com.redhat.quarkus.platform/[email protected]?type=pom&repository_url=https://maven.repository.redhat.com/ga/",
          "name": "quarkus-bom",
          "version": "3.2.11.Final-redhat-00001"
        }
      ]
}

This work supports correlation work litigated in #1014

[dejanb]

LGTM

[ctron]

I think there are a few things to iron out.

Also, let's have a chat about this is the right approach. To my understanding, this only affects the in-memory model. Not the actual DB data, right?

[JimFuller-RedHat]

@dejanb @ctron - added relationship type with 'Undefined' for this kind of relationship.