`convert` command incorrectly converts license values

**What happened**:

```
syft convert hello.spdx -o cyclonedx-json=hello.cdx.json
syft convert hello.cdx.json -o spdx-tag-value=hello-converted.spdx
```
[hello.spdx.txt](https://github.com/anchore/syft/files/12817383/hello.spdx.txt)
[hello.cdx.json.txt](https://github.com/anchore/syft/files/12817384/hello.cdx.json.txt)
[hello-converted.spdx.txt](https://github.com/anchore/syft/files/12817385/hello-converted.spdx.txt)

SPDX is invalid:
```
pyspdxtools -i hello-converted.spdx
ERROR:root:There have been issues while parsing the provided document:
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 14
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 15
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 16
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 17
```
_(Edit: this has been broken off into #3067 )_

Also, ```hello.spdx```has:
```
PackageLicenseConcluded: MIT
PackageLicenseDeclared: GPL-3.0-or-later OR MIT
```

This becomes in ```hello-converted.spdx```:
```
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: (GPL-3.0-or-later OR MIT) AND MIT
```

**What you expected to happen**:

The SPDX file should be valid SPDX. _(Edit: this has been broken off into #3067 )_

I am not a CycloneDX expert, but from my understanding, CycloneDX cannot make the difference between
declared and concluded licences, so it cannot store both.
So it is OK to have
```
PackageLicenseConcluded: NOASSERTION
```
But
```
PackageLicenseDeclared: (GPL-3.0-or-later OR MIT) AND MIT
```
is clearly incorrect.

**Steps to reproduce the issue**:

See above

**Anything else we need to know?**:

**Environment**:
- Output of `syft version`: syft 0.92.0
- OS (e.g: `cat /etc/os-release` or similar): MacOS 13.6

Start by reproducing the `syft convert` commands with the attached `hello.spdx.txt` and `hello.cdx.json.txt` files, then trace how the convert command maps CycloneDX license data to SPDX fields. Done means the generated SPDX preserves a valid declared-license expression without incorrectly combining it with the concluded license, and the result is accepted by an SPDX validator.

Written by the indexing model from the issue text.