Identify SPDX license identifiers

**What would you like to be added**:
The ability to identify SPDX license identifiers from individual files, such as:
```golang
/* SPDX-License-Identifier: GPL-3.0-or-later */

package main

import "fmt"

func main() {
// ...
}
```

Here's an example source repo where all of the source files (including github workflows) have these SPDX tags https://github.com/agherzan/git-mirror-me

**Why is this needed**:
This is helpful for folks that are most interested in scanning source repositories over container artifacts or other binary artifacts.

Start by reviewing Syft's source-repository and filesystem scanning entry points, then compare the requested behavior with the SPDX-tagged files in the linked git-mirror-me repository. Done means individual source files, including workflow files, have their SPDX-License-Identifier values identified during repository scanning.

Written by the indexing model from the issue text.