SPDX JSON 2.2 should handle reference category PACKAGE_MANAGER

[kzantow]

The original SPDX 2.2 JSON schema only defined PACKAGE_MANAGER, not PACKAGE-MANAGER as allowed for the external reference category (note: the latest 2.2 JSON schema and 2.3 spec do include the dash-versions). This is in conflict with the spec and tag-value, which only defines the latter, PACKAGE-MANAGER. However, this causes problems with interoperability and we should handle these cases more nicely. As tools are supposed to accept both values, this can help a bit to normalize to PACKAGE-MANAGER in the tools-golang library.

[lumjjb]

Addressed by #204