feat(model): Sort SpdxExpressions in more places on serialization

This eases comparison of serialized files.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>

Author: sschuberth

model/src/main/kotlin/Package.kt

@@ -27,6 +27,7 @@ import org.ossreviewtoolkit.model.utils.requireNotEmptyNoDuplicates
 import org.ossreviewtoolkit.model.utils.toPurl
 import org.ossreviewtoolkit.utils.ort.DeclaredLicenseProcessor
 import org.ossreviewtoolkit.utils.ort.ProcessedDeclaredLicense
+import org.ossreviewtoolkit.utils.ort.SpdxExpressionSortedConverter
 import org.ossreviewtoolkit.utils.ort.StringSortedSetConverter
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 import org.ossreviewtoolkit.utils.spdx.SpdxOperator
@@ -85,6 +86,7 @@ data class Package(
      * ORT itself does not set this field, it needs to be set by the user using a [PackageCuration].
      */
     @JsonInclude(JsonInclude.Include.NON_NULL)
+    @JsonSerialize(converter = SpdxExpressionSortedConverter::class)
     val concludedLicense: SpdxExpression? = null,
 
     /**

model/src/main/kotlin/config/LicenseFindingCuration.kt

@@ -24,6 +24,7 @@ import com.fasterxml.jackson.databind.annotation.JsonDeserialize
 import com.fasterxml.jackson.databind.annotation.JsonSerialize
 import com.fasterxml.jackson.databind.util.StdConverter
 
+import org.ossreviewtoolkit.utils.ort.SpdxExpressionSortedConverter
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 
 /**
@@ -57,12 +58,14 @@ data class LicenseFindingCuration(
      * [detectedLicense] or if [detectedLicense] is null.
      */
     @JsonInclude(JsonInclude.Include.NON_NULL)
+    @JsonSerialize(converter = SpdxExpressionSortedConverter::class)
     val detectedLicense: SpdxExpression? = null,
 
     /**
      * The concluded license as SPDX expression or [org.ossreviewtoolkit.utils.spdx.SpdxConstants.NONE] for no license,
      * see https://spdx.dev/spdx-specification-21-web-version#h.jxpfx0ykyb60.
      */
+    @JsonSerialize(converter = SpdxExpressionSortedConverter::class)
     val concludedLicense: SpdxExpression,
 
     /**