Revamp SPDX Parser

[abhisek]

• Deprecate pkg/parser/custom
• Introduce pkg/parser/spdx.go
• Use the graph parser model to parse spdx documents

Ref: https://github.com/safedep/vet/blob/main/pkg/parser/cyclonedx.go

It is important to get this parser to be reliable because GitHub Dependency Graph API produces SPDX documents. We need to parser the response reliably.