update spdx parsing and check for spdxIdentifier==DOCUMENT

[lumjjb]

Description of the PR

Fix SPDX parsing and update to check that SPDXIdentifier is consistent for #979

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged