github.com/lineaje-labs/syft@v0.98.1-0.20231227153149-9e393f60ff1b/syft/format/spdxtagvalue/test-fixtures (about) bad-sbom identify snapshot tag-value.spdx