3030 license declared spdx correction

[spiffcs]

Description

The syft format helpers for spdx currently treat License-Ref-* as a valid spdx expression. This causes our selection on l.Value to be partially incorrect when trying to add licenses to the hasExtractedLicensingInfos in the spdx document.

This change updates the spdx helpers so that singular License-Ref candidates are added to this section.

• Fixes LicenseDeclared not as per SPDX License List #3030

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections