SPDX output sets invalid empty checksums

The following line sets the SHA1 checksum of a file to an empty string in SPDX if not present:
https://github.com/nexB/scancode-toolkit/blob/a15174f31efaf8816e8c9a65c9f85c4beffc0227/src/formattedcode/output_spdx.py#L294

This is not valid in SPDX, see [here](https://spdx.github.io/spdx-spec/v2.3/file-information/#84-file-checksum-field).
The 0.7 version of `spdx-tools` erroneously supports empty checksum strings in the package verification code calculation, which will be fixed in the upcoming 0.8 release. This means that the current state of empty checksum strings in SPDX output will actually lead to an error.

There are at least two options to fix this:
- Set `filesAnalyzed=False` for the package and leave out any file information and the verification code of that package.
- Raise an error indicating that the determination of the checksum failed for the file and thus no SPDX can be produced.

As a workaround, one might set the unknown file checksum to be the empty file hash, but that wouldn't give the correct verification code, either.