Bump Syft from 0.60.3 to 0.66.1

[sophiewigmore]

Summary

• Bump Syft from 0.60.3 to 0.66.1

• Adds internal SPDX 2.2 support, since Syft v0.66.1 now supports 2.3

  • SPDX 2.2 SBOMs generated with packit now look slightly different than before. There are now fields that contain null or empty values.
  • This is a tradeoff of using the upstream Syft SPDX helpers, which do not have omitempty set for many fields, so they now show up with null entries. The old version of the code we were using before (v0.60.3) had the omitempty, so these fields didn't show up before.
  • As far as I can tell, all of these new fields are a part of the SPDX 2.2 spec, and shouldn't cause an issue with validity.
  • The alternative is to copy in the Syft 0.60.3 version of SPDX helpers so we can continue to produce identical SBOMs.

• Clean up Syft and CycloneDX models by removing as much copied-in code as possible, and update test fixtures

• Fixes long-failing SBOM test failures

• Add clarifying comments

Addressing TODO items around picking up latest schema versions will not be addressed in this PR

Checklist

• I have viewed, signed, and submitted the Contributor License Agreement.
• I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• I have added an integration test, if necessary.
• I have reviewed the styleguide for guidance on my code quality.
• I'm happy with the commit history on this PR (I have rebased/squashed as needed).