Enhance SBOM docs for component scope

[stevespringett]

Related to CycloneDX/specification#293

Need to expand component scope definition and examples. Along with providing some clarity on how this can be utilized with lifecycles.

[jkowalleck]

see also this comment from @stevespringett
CycloneDX/specification#293 (comment)

scope is a way to include a component but not assert that that component is delivered or included in the inventory. For example, you may want to include Windows XP Embedded as a component, mark the scope as excluded, as a way to indicate that the entire stack will include the OS, but that the supplier does not provide it with the software. There is ongoing discussions within CISA on how to specify runtime requirements. Expect this capability to expand in the future.