syft should error if not specifying sha1 for SPDX

**What happened**:
Syft generates SPDX SBOM with only md5, sha256, etc. if specified in config. SPDX requires one of the checksums included be sha1.

**What you expected to happen**:
Either Syft should error stating that sha1 must be included as well, or it should use any non-sha1 digest in addition to the required sha1.

**How to reproduce it (as minimally and precisely as possible)**:
Include a syft.yaml config with:
```
digests: ["sha256"]
```

and run syft while generating SPDX.

**Environment**:
- Output of `syft version`: `syft 0.58.0`
- OS (e.g: `cat /etc/os-release` or similar):
```
BUG_REPORT_URL="https://github.com/NixOS/nixpkgs/issues"
BUILD_ID="22.11pre400549.af9e00071d0"
DOCUMENTATION_URL="https://nixos.org/learn.html"
HOME_URL="https://nixos.org/"
ID=nixos
LOGO="nix-snowflake"
NAME=NixOS
PRETTY_NAME="NixOS 22.11 (Raccoon)"
SUPPORT_URL="https://nixos.org/community.html"
VERSION="22.11 (Raccoon)"
VERSION_CODENAME=raccoon
VERSION_ID="22.11"
```

Reproduce the issue with a syft.yaml containing digests: ["sha256"], then generate an SPDX SBOM using the Syft CLI. Trace how configured digests are handled for SPDX output and confirm the resulting checksum set against SPDX's SHA-1 requirement. Done means the CLI either reports the missing SHA-1 configuration or emits SPDX with SHA-1 plus the configured digest.

Written by the indexing model from the issue text.