Support for spdx-tools >= 0.8

[fabaff]

Describe the issue
The 0.8 version of the spdx-toolsmodule lays the groundwork for the upcoming SPDX-3.0 implementation. Unfortunately 0.8 contains breaking changes.

At first glance it looks like that at least common/output/spdx.py needs some modifications.

Version (please complete the following information):

• Checkov Version: latest

Additional context
This issue is mainly relevant for distributions which are shipping checkov as package and not users who are running with a Python venv.

[gruebel]

hey @fabaff thanks for reaching out.

We intentionally upper bounded it, because the 0.8.0 version will introduce breaking changes. So, thanks for letting us know, because I was not aware it was already released. I don't think it will be a heavy lift on our side, because it is just used to create the SPDX output 😄