Include nested components in version diffs

[sueun-dev]

ComponentVersionDiff only compares the top-level Bom.Components lists. A version change inside an assembly is omitted: in a local CLI build, changing a nested library from version 1 to 2 prints None, even though both input BOMs validate.

Walk the nested Components lists before the existing group/name/version comparison. The tests cover nested additions, removals, changes and unchanged versions, movement into an assembly, flat components, and exclusion of pedigree ancestors.

Checked on Linux arm64 with .NET 8 and 10:

• New regressions: 9 failures and 5 passes before, 14 passes after, per framework.
• dotnet clean && dotnet build --no-restore /WarnAsError && dotnet test --no-restore: build succeeds with no warnings; 2,884 tests pass and one existing memory test is skipped per framework.
• The local CLI comparison passes all 20 JSON/XML cases after the fix, versus 4 before. The 40 input fixtures validate; a malformed control is rejected.

DocFX 2.78.3 completes with the same 13 warnings before and after, including NU1902 warnings for Microsoft.Build.Tasks.Git. The Windows matrix was not run locally.