Minor nitpick:
DiscoveredPackage used uuid field
https://github.com/nexB/scancode.io/blob/5f2cbae33c1ac7fa843fb4bddf9ab3f62fc831b2/scanpipe/models.py#L2534-L2536

DiscoveredDependency uses a CharField
https://github.com/nexB/scancode.io/blob/5f2cbae33c1ac7fa843fb4bddf9ab3f62fc831b2/scanpipe/models.py#L2837-L2840

We need to discuss the distinction between a Package and a Dependency.

1. When is a dependency not a package ?
2. All all packages dependency of the project being scanned currently
3. CycloneDX schema's dependencies are only a mapping from a component to a component, should we opt for a similar approach ?