Add support for generating SPDX 2.3 and 3.0 files

[tsteenbe]

SPDX will soon release SPDX 2.3 which at a high level includes the following changes

1. Support for exchanging security information see https://github.com/spdx/spdx-spec/blob/development/v2.3/chapters/external-repository-identifiers.md and https://github.com/spdx/spdx-spec/blob/development/v2.3/chapters/how-to-use.md
2. Several fields have become optional see new SPDX 2.3 schema in https://github.com/spdx/spdx-spec/pull/716/files

Propose we update ORT's SPDX Document Reporter so it can generate 2.2 and 2.3 (and later 3.0)

[tsteenbe]

Does it make sense to implement #4696 in the context of this issue?

[sschuberth]

Does it make sense to implement #4696 in the context of this issue?

I just closed that issue as validation against spdx-schema.json has been implemented as part of #5224.

[tsteenbe]

@goneall made the following list highlighting 2.3 versus 2.2 changes see spdx/spdx-spec#691 (comment)