Consider handling SPDX

[mxmehl]

So far, all operations are based on CycloneDX SBOMs. Also supporting SPDX might involve a larger refactoring, perhaps even an internal file format from which we convert.

Perhaps it might be easier to run conversion tools beforehand.