explore if we can remove build deps

cargo cyclone-dx can now mark build dependencies as "excluded":

```
0.5.5 - 2024-07-01
Changed

    Build dependencies are now recorded with scope: "excluded", to indicate that they are not used at runtime. (https://github.com/CycloneDX/cyclonedx-rust-cargo/pull/755)
```

This means we might be able to drop the "build deps" section from allowed.json.