Remove support for SPDX

[stevespringett]

In a recent draft response to NIST regarding the Executive Order, OpenSSF (Linux Foundation) had an initial statement from David Wheeler that they would pay to write SPDX plugins. SPDX is over ten years old, has fewer tools that other SBOM standards and LF has entertained the idea of paying others to support it.

The text was subsequently changed, however, David Wheeler is the Director of Open Source Supply Chain Security at the Linux Foundation, and is in a position of knowing strategically what the foundation is doing
https://docs.google.com/document/d/13SS6u2bQswfRYNi-WXm4dJZkgGHZK7slYZQ75HXTVns/edit?disco=AAAAIlxfpo4

This type of forced standard does not align to the values of the Dependency-Track project.

Support for SPDX will be removed from a future version.

https://docs.google.com/document/d/13SS6u2bQswfRYNi-WXm4dJZkgGHZK7slYZQ75HXTVns/edit

[stevespringett]

Clarification. This only applies to SPDX SBOMs, not SPDX license IDs or expressions.

[stevespringett]

It has come to the attention of the OWASP and CycloneDX community, that SPDX is copying/pasting code, line-by-line from some CycloneDX projects into their own projects, without any form of attribution.

Two such examples are:

---

https://github.com/spdx/spdx-sbom-generator/blob/693b2a2df4c166b097e3c7c09df6861250e8e877/internal/modules/gomod/handler.go#L125-L138
vs.
https://github.com/CycloneDX/cyclonedx-gomod/blob/91534cd0bedaaea8d50af2eb6a4a03cb9cd0d605/internal/gomod/gomod.go#L177-L190

---

https://github.com/spdx/spdx-sbom-generator/blob/693b2a2df4c166b097e3c7c09df6861250e8e877/internal/modules/gomod/handler.go#L64-L81
vs.
https://github.com/CycloneDX/cyclonedx-gomod/blob/cb6081aaaeaccba1b47477b968079e718db49427/internal/gocmd/gocmd.go#L11-L29

---

Giving credit appears to be a hard thing for the SPDX team to do: (CycloneDX/cyclonedx-gomod#20 (comment) -> https://twitter.com/lorenc_dan/status/1397879783078379522).

Due to these practices, removal of SPDX from OWASP Dependency-Track has been expedited. No future release of Dependency-Track will include support for SPDX.