feat: update syft license construction to be able to look up by URL (#4132)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

syft/license/license.go

@@ -4,6 +4,7 @@ package license
 import (
 	"fmt"
 	"runtime/debug"
+	"strings"
 
 	"github.com/github/go-spdx/v2/spdxexp"
 
@@ -17,6 +18,18 @@ const (
 	Concluded Type = "concluded"
 )
 
+// trimFileSuffix removes common file extensions from the end of a string
+func trimFileSuffix(s string) string {
+	suffixes := []string{".txt", ".pdf", ".html", ".htm", ".md", ".markdown", ".rst", ".doc", ".docx", ".rtf", ".tex", ".xml", ".json"}
+	lower := strings.ToLower(s)
+	for _, suffix := range suffixes {
+		if strings.HasSuffix(lower, suffix) {
+			return s[:len(s)-len(suffix)]
+		}
+	}
+	return s
+}
+
 func ParseExpression(expression string) (ex string, err error) {
 	// https://github.com/anchore/syft/issues/1837
 	// The current spdx library can panic when parsing some expressions
@@ -28,10 +41,26 @@ func ParseExpression(expression string) (ex string, err error) {
 		}
 	}()
 
+	// Try with the original expression first
 	licenseID, exists := spdxlicense.ID(expression)
 	if exists {
 		return licenseID, nil
 	}
+
+	// Check if the expression is a URL and try to look it up
+	if info, found := spdxlicense.LicenseByURL(expression); found {
+		return info.ID, nil
+	}
+
+	// Try with trimmed file suffix
+	trimmed := trimFileSuffix(expression)
+	if trimmed != expression {
+		// Try as a URL with the trimmed version
+		if info, found := spdxlicense.LicenseByURL(trimmed); found {
+			return info.ID, nil
+		}
+	}
+
 	// If it doesn't exist initially in the SPDX list it might be a more complex expression
 	// ignored variable is any invalid expressions
 	// TODO: contribute to spdxexp to expose deprecated license IDs