Refine CycloneDX support #1888

Only deal with an SPDX license_expression and not plain licenses or
declared licenses, because this is the only correct license information.

Removing most type hints since we are not yet checking these.

Remove dependency lookup which could be misleading. Instead add warning
if dependencies are skipped.

Add docstring to most methods and functions.

Streamline nested list comprehensions and filter/map constructions and
replace these with simpler constructs.

Replace JSON encoder by a plain to_dict() serialization throughout.

Move attrs attributes declarations towards the top of classes
declarations rather than at the bottom.

Move move method-like functions to their respective objects, including
moving XML serialization functions to to_xml_element() methods for each
model object.

Use factories for fields defaults such as URN and timestamp.

Split method that work on ScanCode packages lists in two: one operating
on a single package mapping and one working on the packages list.

Update tests to work on larger set of expected data.

Always return all attributes, including empty values for now.

Signed-off-by: Philippe Ombredanne <pombredanne@nexb.com>

Author: pombredanne

setup.cfg

@@ -198,7 +198,7 @@ scancode_output =
     template = formattedcode.output_html:CustomTemplateOutput
     debian = formattedcode.output_debian:DebianCopyrightOutput
     yaml = formattedcode.output_yaml:YamlOutput
-    cyclonedx = formattedcode.output_cyclonedx:CycloneDxOutput
+    cyclonedx = formattedcode.output_cyclonedx:CycloneDxJsonOutput
     cyclonedx-xml = formattedcode.output_cyclonedx:CycloneDxXmlOutput