SPDX 2->3 conversion of filesAnalyzed

[armintaenzertng]

Part of #74:

There is no integrity profile to take the place of requiring checksums for files. Some uses of filesAnalyzed indicate that a certain level of tooling was applied to the source. We would lose this information if this field is removed.

Gary's comment from #74:

I wonder if the build profile would service this purpose?

Brandon Lum's comment from #74:

The build profile has some established relationships on the files themselves. So the information would be encodable by the build profile relationships. However, that is just the ability to express the relationship. I'd be curious to discuss what the integrity story would look like (as it ties into verification). I think that's probably something to discuss... since with the build profile the granularity of identities may be more granular and harder to manage.

[goneall]

Kate and I discussed this - perhaps we should introduce an "Integrity Profile" in release 3.1.