feat(sbom): Add marshal for spdx

[masahiro331]

Description

Add RelationShip for SPDX

Add RelationShip document for spdx output.
The following dependencies are added.

Add purl to SPDX.

This change is necessary for vulnerability detection using SPDX.
#2170 (comment)

Before

                {
                        "SPDXID": "SPDXRef-fe2fe0f208812c6b",
                        "filesAnalyzed": false,
                        "licenseConcluded": "GPLv2+",
                        "licenseDeclared": "GPLv2+",
                        "name": "hostname",
                        "versionInfo": "3.20"
                }

After

                {
                        "SPDXID": "SPDXRef-fe2fe0f208812c6b",
                        "externalRefs": [
                                {
                                        "referenceCategory": "PACKAGE-MANAGER",
                                        "referenceLocator": "pkg:rpm/centos/hostname@3.20-6.el8?arch=aarch64\u0026distro=centos-8.4.2105",
                                        "referenceType": "purl"
                                }
                        ],
                        "filesAnalyzed": false,
                        "licenseConcluded": "GPLv2+",
                        "licenseDeclared": "GPLv2+",
                        "name": "hostname",
                        "versionInfo": "3.20"
                }

Related issues

• Close Add PURL to SPDX #2554

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Where is it used?

[knqyf263]

What is it for?