Add a new SPDX reporter based on the SPDX java library

[fviernau]

Using the SPDX java library 1 to produce SPDX reports would benefit ORT as follows:

1. The SPDX java library would allow for configuring the SPDX version to output,
   so it simplifies adding support for additional SPDX versions.
2. It reduces the usage of ORT's own SPDX data model by 1 and thereby
   makes it easier to get rid of that own data model to reduce maintenance cost.
3. ORT's output will be better aligned with the output of other tools. If there is a mistake,
   the mistake is shared / common and thus less problematic for ORT.

Approach:

• Add a new, separate reporter module, using 1 and keep the "old" reporter for now.
• The output should be similar (not necessarily identical, with the "old" reporter).
• This minimizes risk and allows to work incrementally.