vendor: replace spdx/tools-golang with jedevc/spdx-tools-golang

[jedevc]

The relevant commits including refactoring to the struct tags, preventing unneccessary output from the resulting sbom as we import and re-export it.

This should help reduce the size of the resulting SBOMs (minimally).

For example, before:

        "externalRefs": [
          {
            "referenceCategory": "SECURITY",
            "referenceType": "cpe23Type",
            "referenceLocator": "cpe:2.3:a:musl:musl:1.2.3-r4:*:*:*:*:*:*:*",
            "comment": ""
          },

Then, after:

        "externalRefs": [
          {
            "referenceCategory": "SECURITY",
            "referenceType": "cpe23Type",
            "referenceLocator": "cpe:2.3:a:musl:musl:1.2.3-r4:*:*:*:*:*:*:*"
          },

See spdx/tools-golang#174 - when this is merged, we can remove the replace directive.