fix(spdx): use `hasExtractedLicensingInfos` for licenses not in the SPDX license list

[DmitriyLewen]

Description

We can only use licenses from SPDX license list in licenseConcluded and licenseDeclared fields. For other licenses, we should create new LicenseRef-* component (see hasExtractedLicensingInfos field - https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/#d46-license-expressions-in-rdf) and use this component in licenseConcluded and licenseDeclared See more details here - https://github.com/aquasecurity/trivy/discussions/7716

Discussed in https://github.com/aquasecurity/trivy/discussions/7716