feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/pkg/cataloger/php/package_test.go

@@ -11,30 +11,39 @@ import (
 func Test_packageURL(t *testing.T) {
 	tests := []struct {
 		name     string
-		metadata pkg.PhpComposerJSONMetadata
+		metadata parsedData
 		expected string
 	}{
 		{
 			name: "with extractable vendor",
-			metadata: pkg.PhpComposerJSONMetadata{
-				Name:    "ven/name",
-				Version: "1.0.1",
+			metadata: parsedData{
+				[]string{},
+				pkg.PhpComposerJSONMetadata{
+					Version: "1.0.1",
+					Name:    "ven/name",
+				},
 			},
 			expected: "pkg:composer/ven/name@1.0.1",
 		},
 		{
 			name: "name with slashes (invalid)",
-			metadata: pkg.PhpComposerJSONMetadata{
-				Name:    "ven/name/component",
-				Version: "1.0.1",
+			metadata: parsedData{
+				[]string{},
+				pkg.PhpComposerJSONMetadata{
+					Name:    "ven/name/component",
+					Version: "1.0.1",
+				},
 			},
 			expected: "pkg:composer/ven/name-component@1.0.1",
 		},
 		{
 			name: "unknown vendor",
-			metadata: pkg.PhpComposerJSONMetadata{
-				Name:    "name",
-				Version: "1.0.1",
+			metadata: parsedData{
+				[]string{},
+				pkg.PhpComposerJSONMetadata{
+					Name:    "name",
+					Version: "1.0.1",
+				},
 			},
 			expected: "pkg:composer/name@1.0.1",
 		},