fix(sbom): add FilesAnalyzed and PackageVerificationCode fields for SPDX

[DmitriyLewen]

Description

In SPDX 2.3 we can't use FilesAnalyzed == false for packages with Files - If false, the package shall not contain any files. - https://spdx.github.io/spdx-spec/v2.3/package-information/#781-description

So we need to use FilesAnalyzed == true and fill PackageVerificationCode field for these packages.

Related PRs

• chore(deps): bump github.com/spdx/tools-golang from 0.5.0 to 0.5.3 #5495

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).