feat: update syft license concept to complex struct (#1743)

this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from

test/integration/encode_decode_cycle_test.go

@@ -72,14 +72,14 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 				require.NotNil(t, format)
 
 				by1, err := formats.Encode(originalSBOM, format)
-				assert.NoError(t, err)
+				require.NoError(t, err)
 
 				newSBOM, newFormat, err := formats.Decode(bytes.NewReader(by1))
-				assert.NoError(t, err)
-				assert.Equal(t, format.ID(), newFormat.ID())
+				require.NoError(t, err)
+				require.Equal(t, format.ID(), newFormat.ID())
 
 				by2, err := formats.Encode(*newSBOM, format)
-				assert.NoError(t, err)
+				require.NoError(t, err)
 
 				if test.redactor != nil {
 					by1 = test.redactor(by1)

test/integration/package_deduplication_test.go

@@ -77,6 +77,7 @@ func TestPackageDeduplication(t *testing.T) {
 
 				// with multiple packages with the same name, something is wrong (or this is the wrong fixture)
 				require.Len(t, pkgs, expectedInstanceCount)
+
 				for _, p := range pkgs {
 					nameVersion := fmt.Sprintf("%s-%s", name, p.Version)
 					expectedLocationCount, ok := tt.locationCount[nameVersion]