feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

syft/source/location.go

@@ -51,6 +51,12 @@ func (l Location) WithAnnotation(key, value string) Location {
 	return l
 }
 
+func (l Location) WithoutAnnotations() Location {
+	l.LocationMetadata.Annotations = map[string]string{}
+
+	return l
+}
+
 // NewLocation creates a new Location representing a path without denoting a filesystem or FileCatalog reference.
 func NewLocation(realPath string) Location {
 	return Location{

syft/source/location_set.go

@@ -82,6 +82,13 @@ func (s *LocationSet) CoordinateSet() CoordinateSet {
 	return set
 }
 
+func (s *LocationSet) Empty() bool {
+	if s.set == nil {
+		return true
+	}
+	return len(s.set) == 0
+}
+
 func (s LocationSet) Hash() (uint64, error) {
 	// access paths and filesystem IDs are not considered when hashing a location set, only the real paths
 	return hashstructure.Hash(s.CoordinateSet().Paths(), hashstructure.FormatV2, &hashstructure.HashOptions{

syft/source/unindexed_directory_resolver.go

@@ -231,13 +231,7 @@ func (u UnindexedDirectoryResolver) AllLocations() <-chan Location {
 				return nil
 			}
 			p = strings.TrimPrefix(p, "/")
-			out <- Location{
-				LocationData: LocationData{
-					Coordinates: Coordinates{
-						RealPath: p,
-					},
-				},
-			}
+			out <- NewLocation(p)
 			return nil
 		})
 		if err != nil {
@@ -283,14 +277,8 @@ func (u UnindexedDirectoryResolver) newLocation(filePath string, resolveLinks bo
 		}
 	}
 
-	return &Location{
-		LocationData: LocationData{
-			Coordinates: Coordinates{
-				RealPath: realPath,
-			},
-			VirtualPath: virtualPath,
-		},
-	}
+	l := NewVirtualLocation(realPath, virtualPath)
+	return &l
 }
 
 //nolint:gocognit