feat: complete SPDX expression detection

current [`LicenseExpression`](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/cdea937ef598177226280090952a7a4fc350a6b1/src/models/license.ts#L26) 
uses a best effort SPDX detection.

maybe use <https://www.npmjs.com/package/spdx-expression-parse>