feat: environment licenses as proper SPDX

[jkowalleck]

fixes #459

[jkowalleck]

wanna review?
@a1lu @andife

[andife]

I had just a quick looking at the result: https://github.com/andife/cyclonedx-python/actions/runs/6036254421
The result seems to be better.

But I've some question:

I do not know, but if we have a valid "id", do we also have to mention the "name"?

The explanation for "name":
"If SPDX does not define the license used, this field may be used to provide the license name"
https://cyclonedx.org/docs/1.4/json/#components_items_licenses_items_license_name

According to the code, I thought

could be mapped ?

[jkowalleck]

I do not know, but if we have a valid "id", do we also have to mention the "name"?

impossible. according to CycloneDX specification it is EITHER id OR name required, not both, not none.

According to the code, I thought [...] could be mapped ?

how comes?

cyclonedx-python/cyclonedx_py/_internal/license_trove_classifier.py

Lines 82 to 84 in 306e8a8

	# 'License :: OSI Approved :: Apache Software License': which one?
	# - Apache-1.1
	# - Apache-2.0

[andife]

I do not know, but if we have a valid "id", do we also have to mention the "name"?

impossible. according to CycloneDX specification it is EITHER id OR name required, not both, not none.

so for py-serializable we know the "Apache 2.0", it's an "id"... there should not be a "name" "Apache Software License"...? For this unique mapping in general we have already the solution => "Apache 2.0"

According to the code, I thought [...] could be mapped ?

how comes?

cyclonedx-python/cyclonedx_py/_internal/license_trove_classifier.py

Lines 82 to 84 in 306e8a8

	# 'License :: OSI Approved :: Apache Software License': which one?
	# - Apache-1.1
	# - Apache-2.0

you are right... maybe one has to ask Github per API...

[jkowalleck]

so for py-serializable we know the "Apache 2.0", it's an "id"... there should not be a "name" "Apache Software License"...? For this unique mapping in general we have already the solution => "Apache 2.0"

where does this solution come from?
please read https://peps.python.org/pep-0639/#mapping-license-classifiers-to-spdx-identifiers

maybe one has to ask Github per API...

why would you ask githhub for a package that you have installed locally?