feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/file/license.go

@@ -0,0 +1,32 @@
+package file
+
+import (
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/license"
+)
+
+type License struct {
+	Value           string
+	SPDXExpression  string
+	Type            license.Type
+	LicenseEvidence *LicenseEvidence // evidence from license classifier
+}
+
+type LicenseEvidence struct {
+	Confidence int
+	Offset     int
+	Extent     int
+}
+
+func NewLicense(value string) License {
+	spdxExpression, err := license.ParseExpression(value)
+	if err != nil {
+		log.Trace("unable to parse license expression: %s, %w", value, err)
+	}
+
+	return License{
+		Value:          value,
+		SPDXExpression: spdxExpression,
+		Type:           license.Concluded,
+	}
+}