Unwanted check collisions are possible

This library supports reusing check implementations across different specification. It also combines identical checks together in the output, and lists which specifications each check was a part of. This enables output such as "Data License" should be "CC0-1.0". [Google SPDX]`, instead of listing that failed check twice.

However, this increases complexity and can lead to a bug where two checks are wrongly treated as equivalent. This resulted in https://github.com/google/sbom-conformance/pull/60. That PR improves the situation, but there will still be unintended collisions if there are distinct checks with the same identifier (after that PR, the identifier is check name and generated error message").