feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

internal/licenses/parser.go

@@ -4,7 +4,10 @@ import (
 	"io"
 
 	"github.com/google/licensecheck"
-	"golang.org/x/exp/slices"
+
+	"github.com/anchore/syft/syft/license"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
 )
 
 const (
@@ -13,21 +16,24 @@ const (
 )
 
 // Parse scans the contents of a license file to attempt to determine the type of license it is
-func Parse(reader io.Reader) (licenses []string, err error) {
+func Parse(reader io.Reader, l source.Location) (licenses []pkg.License, err error) {
+	licenses = make([]pkg.License, 0)
 	contents, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, err
 	}
 	cov := licensecheck.Scan(contents)
+	if cov.Percent < coverageThreshold {
+		// unknown or no licenses here?
+		return licenses, nil
+	}
 
-	if cov.Percent < float64(coverageThreshold) {
-		licenses = append(licenses, unknownLicenseType)
-	}
 	for _, m := range cov.Match {
-		if slices.Contains(licenses, m.ID) {
-			continue
-		}
-		licenses = append(licenses, m.ID)
+		lic := pkg.NewLicenseFromLocations(m.ID, l)
+		lic.Type = license.Concluded
+
+		licenses = append(licenses, lic)
 	}
-	return
+
+	return licenses, nil
 }