Adapt new and existing package metadata as SPDX relationships

SPDX has the concept of relationships that can be applied to packages, files, or other artifacts. This issue aims to explore what existing metadata can be expressed via SPDX relationships as well as potentially add more metadata to collect via the catalogers that can be expressed as SPDX relationships.

Internal to syft there is already the concept of package-to-package relationships, what isn't clear is if this should be further expanded generally or isolated only to the SPDX presenter (which is generally a new concept, since all data typically gets expressed via the JSON model first).

Start by reviewing Syft's existing package-to-package relationship concept and the SPDX presenter to determine which metadata is already represented. Done means documenting or implementing a decided scope for SPDX relationships and resolving whether the behavior belongs in the shared JSON model or only in the SPDX presenter.

Written by the indexing model from the issue text.