Multiple checksums per entity allowed by spec, but not supported by FIle and Package classes

[njv299]

The SPDX spec allows for multiple checksums to be provided for Packages and Files, but the current Package and File classes only allow a single value to be specified.

See the 'Cardinality' section of the following sections of the spec:

[swinslow]

Just adding a note here, from the SPDX Docfest on Sept. 16 -- looks like this issue leads to errors for valid SPDX documents if they include a FileChecksum with the mandatory SHA1, together with additional optional FileChecksums such as SHA256.

[dholth]

https://github.com/spdx/tools-python/pull/197 can serialize multiple checksums. Parsing them back in is additional work.