Migration guide uses an unsupported osv-scanner SPDX format name

### Problem

The migration guide currently uses an SPDX format name that the osv-scanner CLI rejects:

- `docs/migrating-from-scalibr.md:83` uses `--format spdx-2.3-json`.
- `docs/migrating-from-scalibr.md:95` maps `spdx23-json` to `--format spdx-2.3-json`.
- `internal/reporter/format.go:10` lists the supported format as `spdx-2-3`.

The example therefore fails with `unsupported output format "spdx-2.3-json"`. The output documentation already shows the working command shape: `osv-scanner scan --format spdx-2-3 ...`.

### Expected behavior

The migration guide should use the current supported format name and command shape, including the documented `scan` and `--output-file` flags where appropriate.

Would a maintainer be willing to assign this documentation fix? I can prepare a small, focused PR after assignment.