The SBOM generated by generate-sbom.sh lists every dependency as a component, but some direct dependencies of the in-solution projects (for example AWSSDK.SecurityToken, System.Memory and System.Runtime.CompilerServices.Unsafe) have no dependency path from the root component, so tools that traverse the dependency graph from the root miss them and their subtrees. The cause is that the four driver projects are not components in the SBOM, and their direct dependencies are not attached to the root. Fix the generator so every included component is reachable from the root, on main first and then backport to v3.x. Raised by Copilot review on the v3.x backport PR (CSHARP-6248).