BUG: SBOM import fails with "The 'for_package' cannot be the same as 'resolved_to_package'" and duplicates number of dependencies

[ghsa-retrieval]

Describe the bug
When importing a particular SBOM created with cdxgen, the load_sbom pipeline succeeds according to ScanCode.io, but DejaCode reports issues importing the dependencies. The error message states: The 'for_package' cannot be the same as 'resolved_to_package'

Repeating the SBOM import causes an additional issue. DejaCode duplicates the number of dependencies, apparently not realizing that these are the same dependencies that have been previously added.

Note: This is the same SBOM as aboutcode-org/scancode.io#1576 where ScanCode reported issues with create_dependecies but the overall pipeline is considered a success.

To Reproduce
Not clear yet. Cannot share actual data at the moment. I will see if an MWE can be provided.
If the error provides indication what I should look out for in the SBOM, I might be able to find it quicker.

Expected behavior
The SBOM should be properly loaded and no duplicate dependency entries should be added

Screenshots

Context (OS, Browser, Device, etc.):
n.a.