transitive dep fix and `whitelist_file`

This PR includes some important bug fixes and improvements:

* Properly load a project's transitive dependencies
* Ensure a component is only added to a library once.
* Add `whitelist_file` to software DSL. 
* Remove hard-coded whitelist files from health check.

/cc @christophermaier @lamont-granquist