reafactor(spdx): save undetected liceneses in `ExtractedLicensingInfo`

[DmitriyLewen]

Description

There are cases when SPDX license list doesn't contain license of dependency/package. We need to use ExtractedLicensingInfo field. Example: https://github.com/spdx/tools-java/blob/master/testResources/SPDXJSONExample-v2.2.spdx.json

Discussed in https://github.com/aquasecurity/trivy/discussions/7366