chore: encapsulate dependency-track biz code

[migmartri]

• Decouple dependency-track code from the service layer and put it in its own package in the biz layer.
• The ultimate goal will be potentially merge /biz/integrations and /internal/integrations [fan-out integration] new SDK #38 and this sets the stage for that.

The reason for all these changes is that next we are going to proceed with leveraging CAS instead of OCI directly for SBOM retrieval #2