Use a license id or name instead of an expression if there is only one license

[lfrancke]

Currently, we produce SBOMs like this:

     "licenses": [
        {
          "expression": "MIT"
        }
      ],

There is an argument to be made that it'd be easier for consumers to use the other allowed form in this case:

{"license": {"id": "MIT"}}

Or name if id is not available.
Because then no SPDX expressions need to be parsed.

On the other hand, consumers need to support both methods anyway.

I'm opening this here for discussion, not necessarily because I think it's a bug.