feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/pkg/cataloger/sbom/test-fixtures/alpine/syft-json/sbom.syft.json

@@ -1278,7 +1278,6 @@
    ],
    "licenses": [
     "MPL-2.0",
-    "AND",
     "MIT"
    ],
    "language": "",
@@ -1357,7 +1356,6 @@
    ],
    "licenses": [
     "BSD-2-Clause",
-    "AND",
     "BSD-3-Clause"
    ],
    "language": "",