feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/pkg/package.go

@@ -16,13 +16,14 @@ import (
 
 // Package represents an application or library that has been bundled into a distributable format.
 // TODO: if we ignore FoundBy for ID generation should we merge the field to show it was found in two places?
+// TODO: should cyclonedx tags exist on the struct? Why don't we use the model.Package type?
 type Package struct {
 	id           artifact.ID        `hash:"ignore"`
 	Name         string             // the package name
 	Version      string             // the version of the package
 	FoundBy      string             `hash:"ignore" cyclonedx:"foundBy"` // the specific cataloger that discovered this package
 	Locations    source.LocationSet // the locations that lead to the discovery of this package (note: this is not necessarily the locations that make up this package)
-	Licenses     []string           // licenses discovered with the package metadata
+	Licenses     LicenseSet         // licenses discovered with the package metadata
 	Language     Language           `hash:"ignore" cyclonedx:"language"` // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
 	Type         Type               `cyclonedx:"type"`                   // the package type (e.g. Npm, Yarn, Python, Rpm, Deb, etc)
 	CPEs         []cpe.CPE          `hash:"ignore"`                      // all possible Common Platform Enumerators (note: this is NOT included in the definition of the ID since all fields on a CPE are derived from other fields)
@@ -64,6 +65,7 @@ func (p *Package) merge(other Package) error {
 	}
 
 	p.Locations.Add(other.Locations.ToSlice()...)
+	p.Licenses.Add(other.Licenses.ToSlice()...)
 
 	p.CPEs = cpe.Merge(p.CPEs, other.CPEs)