chore: update spdx license list to 3.24.0 (#2895)

---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

syft/format/common/spdxhelpers/to_format_model.go

@@ -124,7 +124,7 @@ func ToFormatModel(s sbom.SBOM) *spdx.Document {
 		CreationInfo: &spdx.CreationInfo{
 			// 6.7: License List Version
 			// Cardinality: optional, one
-			LicenseListVersion: spdxlicense.Version,
+			LicenseListVersion: trimPatchVersion(spdxlicense.Version),
 
 			// 6.8: Creators: may have multiple keys for Person, Organization
 			//      and/or Tool
@@ -791,3 +791,13 @@ func newPackageVerificationCode(p pkg.Package, sbom sbom.SBOM) *spdx.PackageVeri
 		Value: fmt.Sprintf("%+x", hasher.Sum(nil)),
 	}
 }
+
+// SPDX 2.2 spec requires that the patch version be removed from the semver string
+// for the license list version field
+func trimPatchVersion(semver string) string {
+	parts := strings.Split(semver, ".")
+	if len(parts) >= 3 {
+		return strings.Join(parts[:2], ".")
+	}
+	return semver
+}