install(SBOM) could crash for dependencies outside an export set and
mishandle private dependencies expressed through LINK_ONLY.
Resolve link expressions before target lookup, traverse unexported
dependencies transitively, and isolate document state per configuration.
Preserve target license precedence and align document metadata inheritance
with CPS. Add regression coverage for these cases.
Fixes: #28141Fixes: #28210