feat(parser): mark dev-dependencies component.scope as 'excluded'

[dedsec-terminal]

Description

Per CycloneDX specification, components' scope defines runtime reachability. Development-only dependencies (such as test runners, linters, and build tools) should be scoped as \�xcluded\ so they do not pollute production SBOMs or cause false-positive alerts in downstream SCA compliance scanners.

This pull request implements \ComponentScope.EXCLUDED\ for development-only dependencies in both Poetry and Pipenv parsers:

• Poetry: Parses non-dev groups first so runtime dependencies retain default scope (\scope = None), while dev-only groups (\ ool.poetry.group.dev, \ ool.poetry.dev-dependencies) are assigned \ComponentScope.EXCLUDED.
• Pipenv: Pre-scans lockfile categories so dependencies shared between \develop\ and default/custom categories maintain runtime scope, while develop-only packages receive \ComponentScope.EXCLUDED.
• pyproject.toml: Left unchanged per issue specification pending standardized PEP consensus.

Resolves or fixes issue: #675

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools:
  • LLMs and versions:
  • Prompts:

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python SBOM Tool | 🛠️ Build #35133750 | 📁 Comparing 079e24f against latest (fc11987)

  🔍 Preview build  

No files changed.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 12 complexity · -1 duplication

Metric	Results
Complexity	✅ 12 (≤ 20 complexity)
Duplication	-1

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}