SPDX license list

A frequently asked question is: are there open source license violations in my project? This information is captured in Syft and could be provided as part of the [SPDX output](https://spdx.org/licenses/) and possibly summarized and/or rendered separately from the SBOM output. This may also be better suited in a different action.

Start by reviewing how Syft information is currently exposed in the SPDX output. Clarify whether license-violation information belongs in that output or a separate summary or action; done means the chosen scope and resulting license information are defined and covered by appropriate tests.

Written by the indexing model from the issue text.