fix(sbom): fix error when parent of SPDX Relationships is not a package.

[DmitriyLewen]

Description

When parent from Relationship is not package (e.g. File) - Trivy returns error. (see #6391)
e.g.:

    {
      "relationshipType": "DESCRIBED_BY",
      "relatedSpdxElement": "SPDXRef-DOCUMENT",
      "spdxElementId": "SPDXRef-File--Modules-Microsoft.PowerShell.PSResourceGet--manifest-spdx-2.2-manifest.spdx.json-2B9FB98F5CA97DC84FD382A8F8E68F663C003362"
    }

We only need to add to BOM Relationships relationships between packages

Related issues

• Close Segmentation violation running trivy image with trivy v0.50.0 #6391

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen Could you add a test? I'd like to fully understand the case.

[DmitriyLewen]

I added parent check in SPDX package (like we do for CycloneDX). But I added 1 more check here so that we don't panic if we use this function later somewhere else.

This may be additional change or we may want to add a log message here.
@knqyf263 wdyt?

[knqyf263]

Looks good

[DmitriyLewen]

@knqyf263 added test in 4b74dcd