feat(spdx): extract creator tool and organization from SPDX 2.2 SBOMs

[alisonlomaka]

Summary

Extracts CreatorTool and CreatorOrganization from the creationInfo.creators array in SPDX 2.2 JSON SBOMs.

Changes

• SpdxComponent: Added CreatorTool and CreatorOrganization properties (nullable, omitted from JSON when null via JsonIgnore(WhenWritingNull))
• Spdx22ComponentDetector: Parses Tool: and Organization: prefixed entries from the SPDX creators array (first match wins, empty values treated as null)
• Tests: Added coverage for tool/org extraction, missing creationInfo, multiple creators, and edge cases
• Docs: Updated docs/detectors/spdx.md to document the new fields

[Copilot]

Pull request overview

Adds support in the SPDX 2.2 detector/component model to extract and surface the SBOM creator tool and organization from creationInfo.creators, improving the metadata captured for SPDX documents.

Changes:

• Extend SpdxComponent with CreatorTool and CreatorOrganization fields (omitted from JSON output when null).
• Update Spdx22ComponentDetector to parse Tool: and Organization: creator entries (first match wins).
• Add unit tests covering creator extraction scenarios and update SPDX detector documentation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
test/Microsoft.ComponentDetection.Detectors.Tests/SPDX22ComponentDetectorTests.cs	Adds tests asserting creator tool/org extraction across several creator-array scenarios.
src/Microsoft.ComponentDetection.Detectors/spdx/Spdx22ComponentDetector.cs	Parses creationInfo.creators for Tool: and Organization: and stores results on the component.
src/Microsoft.ComponentDetection.Contracts/TypedComponent/SpdxComponent.cs	Adds new serialized fields for creator tool/organization metadata.
docs/detectors/spdx.md	Documents newly extracted creator tool/organization metadata.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.0%. Comparing base (810548e) to head (93a2320).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #1783   +/-   ##
============================
============================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.