fix: BOM validation fails when Components or Services are nested

[madpah]

This PR will address the root issue raised in #275.

Fixes:

• [BUG] Nested Components or Services breaks BOM validation #275

This PR will also address the following dependency updates:

• chore(deps): bump distlib from 0.3.4 to 0.3.5 #271
• chore(deps): bump types-toml from 0.10.4 to 0.10.8 #270
• chore(deps-dev): bump jsonschema from 4.6.1 to 4.7.2 #269
• chore(deps-dev): bump tox from 3.25.0 to 3.25.1 #256

Comments address - review not dismissing?

[jkowalleck]

@madpah no issue with your implementation. it is solid. and i would not change it at all.
just another view on the problem:

but i thing a tree iterator algorithm on the Set of Component - let's call it ComponentRepository -
would be a better fit. it is similar to the thing you've built. but it shifts the iteration to the set, away from the tree root Component.

why i thing it fits better? Because the set is already a collection - that is iterated.

did this in the JS implementation: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/136/files#diff-91e0bfb8ec98ef0ee09645d5c3ccbfec3d1fcafcc0d74e81c7e3cb08ed0aee31R141-R146
(ignore the strange method name - its just some way to "hide" methods in javascript - similar to the __-prefix in python)