Merge does not deduplicate components with differing bom-ref

[wkoot]

Given the following two test files, their merged output does not deduplicate components as mentioned in CycloneDX/cyclonedx-python-lib#540 (comment)

File test/in1.json:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": {"component": {"bom-ref": "test11", "type": "container", "name": "alpine"}},
  "components": [{"bom-ref": "test12", "type": "operating-system", "name": "alpine"}],
  "dependencies": [{"ref": "test11", "dependsOn": ["test12"]}]
}

and test/in2.json:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": {"component": {"bom-ref": "test21", "type": "container", "name": "alpine"}},
  "components": [{"bom-ref": "test22", "type": "operating-system", "name": "alpine"}],
  "dependencies": [{"ref": "test21", "dependsOn": ["test22"]}]
}

The following merge command:

docker run --rm -v $(pwd)/test:/test cyclonedx/cyclonedx-cli:0.26.0 merge --input-files /test/in1.json /test/in2.json --input-format json --output-format json --output-file /test/out.json --name test

Produces the following output file test/out.json, which contains duplicate components:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:66fa5692-2e9d-45c5-830a-ec8ccaf7dcc9",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "test"
    }
  },
  "components": [
    {
      "type": "operating-system",
      "bom-ref": "test12",
      "name": "alpine"
    },
    {
      "type": "container",
      "bom-ref": "test11",
      "name": "alpine"
    },
    {
      "type": "operating-system",
      "bom-ref": "test22",
      "name": "alpine"
    },
    {
      "type": "container",
      "bom-ref": "test21",
      "name": "alpine"
    }
  ],
  "dependencies": [
    {
      "ref": "test11",
      "dependsOn": [
        "test12"
      ]
    },
    {
      "ref": "test21",
      "dependsOn": [
        "test22"
      ]
    }
  ]
}