feat: SPDX 3 (#4269)

Signed-off-by: Keith Zantow <kzantow@gmail.com>

syft/format/internal/spdxutil/versions.go

@@ -4,9 +4,10 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
-const DefaultVersion = "2.3"
-
 const (
+	DefaultVersion = "2.3"
+	V3_0           = "3.0"
+
 	JSONFormatID     sbom.FormatID = "spdx-json"
 	TagValueFormatID sbom.FormatID = "spdx-tag-value"
 )
@@ -19,7 +20,10 @@ func SupportedVersions(id sbom.FormatID) []string {
 
 	if id != JSONFormatID {
 		// JSON format is not supported in v2.1
-		return append([]string{"2.1"}, versions...)
+		versions = append([]string{"2.1"}, versions...)
+	} else {
+		// is JSON, v3 only supported in JSON format:
+		versions = append(versions, V3_0)
 	}
 
 	return versions