Add externalDocumentRefs to SPDX doc type (ko-build#741)

This commit adds the `externalDocumentRefs` field to the SPDX document. These
will be required to link individual sboms.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

internal/sbom/spdx.go

@@ -150,16 +150,17 @@ const (
 )
 
 type Document struct {
-	ID                string         `json:"SPDXID"`
-	Name              string         `json:"name"`
-	Version           string         `json:"spdxVersion"`
-	CreationInfo      CreationInfo   `json:"creationInfo"`
-	DataLicense       string         `json:"dataLicense"`
-	Namespace         string         `json:"documentNamespace"`
-	DocumentDescribes []string       `json:"documentDescribes,omitempty"`
-	Files             []File         `json:"files,omitempty"`
-	Packages          []Package      `json:"packages,omitempty"`
-	Relationships     []Relationship `json:"relationships,omitempty"`
+	ID                   string                `json:"SPDXID"`
+	Name                 string                `json:"name"`
+	Version              string                `json:"spdxVersion"`
+	CreationInfo         CreationInfo          `json:"creationInfo"`
+	DataLicense          string                `json:"dataLicense"`
+	Namespace            string                `json:"documentNamespace"`
+	DocumentDescribes    []string              `json:"documentDescribes,omitempty"`
+	Files                []File                `json:"files,omitempty"`
+	Packages             []Package             `json:"packages,omitempty"`
+	Relationships        []Relationship        `json:"relationships,omitempty"`
+	ExternalDocumentRefs []ExternalDocumentRef `json:"externalDocumentRefs,omitempty"`
 }
 
 type CreationInfo struct {
@@ -220,3 +221,9 @@ type Relationship struct {
 	Type    string `json:"relationshipType"`
 	Related string `json:"relatedSpdxElement"`
 }
+
+type ExternalDocumentRef struct {
+	Checksum           Checksum `json:"checksum"`
+	ExternalDocumentID string   `json:"externalDocumentId"`
+	SPDXDocument       string   `json:"spdxDocument"`
+}