Investigate OpenChain-Project/SBOM-sg-SEPIA

[pombredanne]

See https://github.com/OpenChain-Project/SBOM-sg-SEPIA by @HansMKern and team

It will provide a mapping between SPDX and CycloneDX. Since we can already read/combine/merge and write back SPDX and CycloneDX here in DejaCode and ScanCofde.io, it will be useful to track how our conversion aligns with these mappings.