fix(sbom-tools): properly do relative lookups for external prod dependencies

fix(sbom-tools): properly do relative lookups for external prod dependencies #812