Syft does not use parent pom.xml for license detection if MANIFEST.MF contains Bundle-License

**What happened**:

Try to generate an SBOM for a project that contains for example `ch.qos.logback.logback-core`

`logback-core` has its license defined in parent pom (`ch.qos.logback.logback-parent`) as well as inside the `MANIFEST.MF`. License data from parent pom is ignored at the moment.

See https://repo1.maven.org/maven2/ch/qos/logback/logback-core/1.5.18/logback-core-1.5.18.pom for example.

**What you expected to happen**:

License data from parent pom is taken, because it is often more precise. `pom.xml` has better ways of representing multi-license projects. See https://repo1.maven.org/maven2/ch/qos/logback/logback-parent/1.5.18/logback-parent-1.5.18.pom for `example.`

License data from `MANIFEST.MF` is not as good, because Syft just takes the value as-is and does not enrich it.

Best output would be a valid license EXPRESSION: For logback-core, it should be something like this:

```
"licenses": [
{
"expression": "EPL-1.0 OR LGPL-2.1-only"
}
]
```

`MANIFEST.MF` from `logback-core`:

This is the Syft output:
Syft thinks that there is only one license available.

```
{
"bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.5.18?package-id=c389ecb99d8108eb",
"type": "library",
"group": "ch.qos.logback",
"name": "logback-core",
"version": "1.5.18",
"licenses": [
{
"license": {
"name": "http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
}
}
],
"cpe": "cpe:2.3:a:logback-core:logback-core:1.5.18:*:*:*:*:*:*:*",
"purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18",
"externalReferences": [
{
"url": "",
"hashes": [
{
"alg": "SHA-1",
"content": "6c0375624f6f36b4e089e2488ba21334a11ef13f"
}
],
"type": "build-meta"
}
],
"properties": [
{
"name": "syft:package:foundBy",
"value": "java-archive-cataloger"
},
{
"name": "syft:package:language",
"value": "java"
},
{
"name": "syft:package:type",
"value": "java-archive"
},
{
"name": "syft:package:metadataType",
"value": "java-archive"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:logback-core:logback_core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:logback_core:logback-core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:logback_core:logback_core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:logback:logback-core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:logback:logback_core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:qos-ch:logback-core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:qos-ch:logback_core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:qos_ch:logback-core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:qos_ch:logback_core:1.5.18:*:*:*:*:*:*:*"
},
{
"name": "syft:location:0:layerID",
"value": "sha256:e9ef3023efd7d4b4dccc5964a23f5c674cb62bde4bbc7d0fae5c8a09fe6ead74"
},
{
"name": "syft:location:0:path",
"value": "/opt/app/detact-apps.jar"
},
{
"name": "syft:metadata:-:artifactID",
"value": "logback-core"
},
{
"name": "syft:metadata:-:groupID",
"value": "ch.qos.logback"
},
{
"name": "syft:metadata:virtualPath",
"value": "/opt/app/detact-apps.jar:BOOT-INF/lib/logback-core-1.5.18.jar"
}
]
}
```

**Steps to reproduce the issue**:

Create project/image containing logback-core 1.5.18
Create Syft CycloneDX SBOM using the following syft config:

```
# https://oss.anchore.com/docs/reference/syft/configuration/

log:
level: trace

javascript:
include-dev-dependencies: false

file:
metadata:
selection: none # we don't want any files in out SBOMs as of now

select-catalogers:
- +javascript-lock-cataloger

java:
resolve-transitive-dependencies: true
max-parent-recursive-depth: -1 # no limit
use-network: true
maven-url: "https://repo1.maven.org/maven2,https://packages.confluent.io/maven"

enrich: "all"

```

**Anything else we need to know?**:

I found https://github.com/anchore/syft/issues/4260 earlier and thought this bug is present again, but `logback-core` has a `pom.properties`. That's the reason why I think the MANIFEST.MF file is the reason for the parent pom not being used.

**Environment**:
- Syft version: 1.42.3

**EDIT**: another good example is the usage of the maven package `antlr4-runtime`

`MANIFEST.MF` contains some unusable URL, but parent `pom.xml` of the project actually contains a usable SPDX identifier.

Start with Syft's Java archive cataloging and Maven parent-POM license resolution, then compare how MANIFEST.MF and pom.xml license data are prioritized. Reproduce with logback-core 1.5.18 and antlr4-runtime using the supplied configuration, and confirm that the generated CycloneDX output preserves the parent POM's SPDX license expression.

Written by the indexing model from the issue text.