Converting spdx-json to syft-json with `syft convert` loses artifact locations

**What happened**:

Syft emits location info in SDPX JSON that it then can't parse when converting back to syft-json.

```
❯ syft -q -o spdx-json busybox:latest | syft convert -q - -o syft-json | jq '.artifacts[0].locations'
null
```

but
```
❯ syft -q -o syft-json busybox:latest | jq '.artifacts[0].locations'
[
{
"path": "/bin/[",
"layerID": "sha256:3694737149b11ec4d2c9f15ad24788e81955cd1c7f2c6f555baf1e4a3615bd26",
"annotations": {
"evidence": "primary"
}
}
]
```
**What you expected to happen**:

I expected some information on artifact locations to be preserved.

**Steps to reproduce the issue**:

```
syft -q -o spdx-json busybox:latest | syft convert -q - -o syft-json | jq '.artifacts[0].locations'
```

**Anything else we need to know?**:

In the SPDX JSON, this is how syft is currently representing the location:

``` json
"relationships": [
{
"spdxElementId": "SPDXRef-Package-binary-busybox-677e82120034c0a0",
"relatedSpdxElement": "SPDXRef-File-bin---947affa7dec8234d",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
```

So the SPDX JSON produced by syft does contain the location information, but it's expressed by a package-to-file relationship of type "OTHER" with "evident-by" in the comment. When syft takes in an SPDX SBOM to convert, it doesn't populate the artifact locations from relationships like this, however.

**Environment**:
- Output of `syft version`:
```
❯ syft version
Application: syft
Version: 0.87.0
JsonSchemaVersion: 10.0.0
BuildDate: 2023-08-14T15:37:24Z
GitCommit: b3d7ba569b64376cf33df717e3bc40d8375e033b
GitDescription: [not provided]
Platform: darwin/arm64
GoVersion: go1.21.0
Compiler: gc
```
- OS (e.g: `cat /etc/os-release` or similar):
```
❯ uname -mr
22.6.0 arm64
```

Start with the `syft convert` command and its SPDX JSON input handling, focusing on package-to-file relationships with type `OTHER` and an `evident-by` comment. Reproduce the command from the issue, then verify that converting the generated SPDX JSON preserves artifact location data in syft-json.

Written by the indexing model from the issue text.