[Defect]: --only options with multiple value not working as expected.

[gkumarcertinia]

Actual Outcomes

Empty SBOM get generate when multiple value (multiple dependency name) passed with --only options.

Expected Outcomes

I was expecting the SBOM report only for all those provided dependencies.

Step to reproduce:

Sample Github repo for ref: https://github.com/gkumarcertinia/test

Additional context

After analysing it further inside the cdxgen I found the following pieces of source code

So according to the above piece of code it seems SBOM will include only those purl which contains all those given value (multiple dependency name).
Instead of all purl should be included in the report which contains any one of those given value (multiple dependency name).

Kindly have a loo and help me on this.

[prabhu]

@gkumarcertinia Nice investigation! Could you send a PR by improving the logic in filterBom?