fix primary comp dangling refs

[viveksahu26]

closes #330

THis PR adds the following changes:

• fixes dangling reference for primary component.
• added functional tests and integration tests for this case(in future will extend this accordinly)
• also added ci/cd workflow to run test coverage + all tests and specifically integration test verbosely.
• also add .gitattributes for end-of-line, eol as lf to avoid different eol for windows/ubuntu. This is important because there is a test case for edit command which compare line by line, and if eol differs then test fails. Therefore it is necessary to set eol same of all os.

Examples:

$  go run main.go assemble --flatMerge --primary primary.cdx.json \ 
  --outputSpecVersion 1.6 extra.cdx.json -o out-new.cdx.json 

o/p:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b0755551-5205-4654-a0d0-5a16978fb829",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-21T06:59:37Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "supplier": {
            "name": "Interlynk",
            "url": [
              "https://interlynk.io"
            ],
            "contact": [
              {
                "email": "support@interlynk.io"
              }
            ]
          },
          "name": "sbomasm",
          "version": "devel",
          "description": "Assembler \u0026 Editor for your sboms",
          "licenses": [
            {
              "license": {
                "id": "Apache-2.0"
              }
            }
          ]
        }
      ]
    },
    "component": {
      "bom-ref": "myapp@1.0.0",
      "type": "application",
      "name": "myapp",
      "version": "1.0.0"
    },
    "licenses": [
      {
        "license": {
          "id": "CC-BY-1.0"
        }
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/extra@2.0.0",
      "type": "library",
      "name": "extra",
      "version": "2.0.0",
      "purl": "pkg:npm/extra@2.0.0"
    },
    {
      "bom-ref": "pkg:pypi/leftpad@1.3.0",
      "type": "library",
      "name": "leftpad",
      "version": "1.3.0",
      "purl": "pkg:pypi/leftpad@1.3.0"
    }
  ],
  "dependencies": [
    {
      "ref": "myapp@1.0.0",
      "dependsOn": [
        "pkg:pypi/leftpad@1.3.0",
        "pkg:npm/extra@2.0.0"
      ]
    }
  ]
}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.