Add files import from SPDX

[jedevc]

List package files in output.

Note: this produces strange results if duplicate files appear in hasFiles, so we skip over them to prevent a panic (though we still produce the wrong result). For syft, this should be fixed in anchore/syft#1168.

[tonistiigi]

Is the files list something that end users would find useful or is it something that could help associate the package with the command that added the package. And in that case we would add a reference to the command in here instead of the file list itself.

[jedevc]

I think both have valid use cases. Knowing the command that added the package is helpful for automated patching tools, etc, but the raw file list by itself is useful I think - if after build, a user discovers an issue with a file, the package file list is an audit trail for "how did this file get here".