Handling of licence expressions

[anthonyharrison]

SPDX and CycloneDX handle license expressions differently.

SPDX handles all licences in the same way regardless of whether it is an expression or not.

CycloneDX can include a license expression or one or more licences. Some SBOM generation tools are using multiple licences instead of an expression to indicate a logical AND of licences.

PROPOSAL (for CycloneDX)
If licence expression, always use SPDX Expression when generating
If multiple licenses, create SPDX Expression with logical AND between licenses when parsing