feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/pkg/cataloger/php/package.go

@@ -8,23 +8,24 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func newComposerLockPackage(m pkg.PhpComposerJSONMetadata, location ...source.Location) pkg.Package {
+func newComposerLockPackage(m parsedData, indexLocation source.Location) pkg.Package {
 	p := pkg.Package{
 		Name:         m.Name,
 		Version:      m.Version,
-		Locations:    source.NewLocationSet(location...),
+		Locations:    source.NewLocationSet(indexLocation),
+		Licenses:     pkg.NewLicenseSet(pkg.NewLicensesFromLocation(indexLocation, m.License...)...),
 		PURL:         packageURL(m),
 		Language:     pkg.PHP,
 		Type:         pkg.PhpComposerPkg,
 		MetadataType: pkg.PhpComposerJSONMetadataType,
-		Metadata:     m,
+		Metadata:     m.PhpComposerJSONMetadata,
 	}
 
 	p.SetID()
 	return p
 }
 
-func packageURL(m pkg.PhpComposerJSONMetadata) string {
+func packageURL(m parsedData) string {
 	var name, vendor string
 	fields := strings.Split(m.Name, "/")
 	switch len(fields) {