Skip components with no matching primary in hierarchical merge

[arpitjain099]

metadata.component is optional in CycloneDX, and buildPrimaryComponentList only records a primary for BOMs that have one. The hierarchical branch of combinedMerge then does this:

var newPc int
...
for i, pc := range priCompList {
    if pc.BOMRef == newPcId {
        newPc = i
        break
    }
}

if priCompList[newPc].Components == nil {

newPc stays 0 when nothing matches, and priCompList[newPc] is indexed unconditionally. Two effects:

• merging BOMs that all lack metadata.component leaves priCompList empty, so this panics with index out of range [0] with length 0
• merging a mix, one BOM with a primary and one without, silently nests the second BOM components under the first BOM primary, which is the wrong parent rather than a crash

Hierarchical merge is the default (config.go sets HierarchicalMerge: true), so plain sbomasm assemble over component-only SBOMs hits it.

The existing log.Error("hierarchical merge: old product does not have any component.") fires just before, but it only substitutes an empty oldPc and execution continues into the index.

This tracks whether the lookup actually matched and skips that BOM contribution with an error log when it did not, rather than defaulting to entry 0.

Test merges two component-only SBOMs through the real combinedMerge. It panics on main with the error above and passes with the change. go test ./pkg/assemble/... is green.