Add support for SPDX v3

### Current Behavior:
* SPDX support was removed for technical (and other) reasons from prior versions of DT
* SPDX currently does not describe what something is, only what something could be. This makes it extremely challenging to support SPDX reliably in DT - one of the technical reasons support was dropped

### Proposed Behavior:
* SPDX v3 will include the necessary information which properly identifies components along with component types (similar to CycloneDX)
* Add an optional and automatic translation layer that converts SPDX into CycloneDX for ingestion into DT
* Limit SPDX support to modern serialization formats, such as JSON, which can be independently validated
* Ideally, this work would be based on the work of @goneall and @coderpatros