Enhance SPDX Support

Completing https://github.com/anchore/syft/issues/213 adds support for generating SPDX documents, however, there are several opportunities to expand upon what can be expressed in an SPDX document. For instance, we have a file cataloger and are aware for select package types which files belong to a package... we could be leveraging the "FilesAnalyzed" package indication and showing the file digests for these package files. Additionally we could be adding relationships between these files and packages. For packages with transitive dependencies known, we could be building a dependency graph. There are many directions this can take, this issue is here as a placeholder to show that we could be supporting more of what can be expressed in an SPDX document.

Explorations to try (but not limited to):
- [ ] #476
- [ ] #477

Start by reading the SPDX-generation work referenced in issue #213 and the exploratory issues #476 and #477. Narrow this placeholder into one concrete enhancement, such as file digests, package-file relationships, or transitive dependency graphs; the work is done when that chosen capability is represented in the generated SPDX document.

Written by the indexing model from the issue text.