Use simpler notation for ExternalRefs in JSON, YAML and XML

[tsteenbe]

In the SPDX 2.2 YAML example I found

externalRefs:
  - referenceCategory: "referenceCategory_security"
    referenceType:
      referenceTypeUri: "http://spdx.org/rdf/references/cpe23Type"
    referenceLocator: "cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:*"
    comment: null

which seems to based on below RDF example in the SPDX 2.1 spec

<spdx:externalRef>
  <spdx:ExternalRef>
    <spdx:referenceCategory rdf:resouce=”http://spdx.org/rdf/terms#referenceCategory_packageManager” />
    <spdx:referenceType rdf:resource=”http://spdx.org/rdf/refeferences/maven-central” />
    <spdx:referenceLocator>org.apache.commons:commons-lang:3.2.1</spdx:referenceLocator>
  </spdx:ExternalRef>
</spdx:externalRef>

Propose to simplify the format for ExternalRef to:

externalRefs:
 - category: "SECURITY"
    type: "cpe23Type"
    locator: "cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:*"
    comment: ""

[tsteenbe]

Proposal based on discussion in the SPDX Tech call on November 19, 2019 - agreed by @kestewart, @goneall, @zvr and @swinslow.

[kestewart]

Reviewed with wider set in today's call, no issues raise. Waiting for PR.

[swinslow]

FYI, in #182 (if it gets merged) I fixed the enums as part of the broader enum reworking, but hadn't otherwise touched the format of ExternalRefs.

[goneall]

Going back over the open issues, it looks like this one is partially resolved.

There was an issue raised on the email thread about incompatibilities between the names of the different formats.

Based on that, I am now thinking we leave the property names in their longer forms so that we don't have a different name for the RDF/XML. Perhaps we can revisit in 3.0 and change the property names for all of the document formats.

There is also an argument to be made to leave the property names in their long form to better describe the semantics for the property name. In the RDF world this is important since the property names carry specific semantic information which can be used in queries.

[kestewart]

From call, Gary indicates that this has been fixed, and all the property names have been addressed.