Add declared-license encoding for root components

[abhinavgautam01]

Summary

• Add SPDX license expressions, non-SPDX license names, and extracted license text to Component.
• Encode root component licenses in CycloneDX JSON, CycloneDX XML and SPDX JSON.
• Generate stable SPDX LicenseRef identifiers for extracted licenses.
• Avoid empty optional containers in CycloneDX XML output.
• Document the declared-license component fields.

This is required by git-pkgs/git-pkgs#310 to move root license serialization into the SBOM library.

Verification

• go mod tidy -diff
• go build ./...
• go test -race ./... -count=1
• golangci-lint run ./...
• CycloneDX JSON and XML validated against the official CycloneDX 1.5 schemas

[andrew]

joinLicenseExpression should use AND, not OR. The three Component fields come from different declaration sources (normalized manifest expression, unrecognized manifest strings, license-file contents); when a project declares MIT in one manifest and points license-file at custom terms in another, both apply. OR grants a choice the project didn't offer. Any actual dual-licensing choice is already encoded inside LicenseExpression by the caller.

One-line change at encode.go:200. The existing parenthesization is correct for AND too. Please also tighten TestEncodeMixedComponentLicenses to assert the top-level conjunction, e.g. strings.Contains(root.LicenseDeclared, ") AND LicenseRef-"), so it's pinned.

Minor, non-blocking:

• componentLicensesToSPDX emits duplicate hasExtractedLicensingInfos entries when inputs repeat; fine for the git-pkgs caller which dedupes, worth a follow-up.
• ExtractedLicense.ID is passed through without a LicenseRef- prefix check; document the constraint on the field or prefix it in extractedLicenseID.
• The xml: tags on cdxBOM/cdxMetadata/cdxComponent and the XMLName/XMLNS fields are dead now the mirror types handle XML encoding.

[abhinavgautam01]

Resolved. Independent component license declarations are now joined with AND; any dual-license choice remains represented inside the caller-provided LicenseExpression.

I also addressed the non-blocking notes in the same update:

• deduplicated hasExtractedLicensingInfos entries by their final LicenseRef
• added the LicenseRef- prefix to explicit IDs when needed
• removed the dead XML fields and tags from the JSON-side CycloneDX model

TestEncodeMixedComponentLicenses now verifies the top-level conjunction, with additional coverage for deduplication and explicit ID normalization.

[andrew]

The follow-up commit addresses the requested license conjunction, deduplication, ID normalization, and serializer cleanup.