fix: reverse direction of SPDX SBOM dependency rels

[bdehamer]

As discussed in #6867 some of the relationship types in the SPDX SBOM are using labels which don't match the direction of the relationship. This change fixes generated relationship entries so that the relationshipType aligns with the direction of the dependency relationship being described.

For some types of relationships SPDX defines a pair of related types which can be used to describe dependency relationships from either parent-to-child or child-to-parent. For example:

{
  "spdxElementId": "parent-1.0.0",
  "relatedSpdxElement": "child-1.0.0",
  "relationshipType": "DEPENDS_ON"
}

Which can also be represented as

{
  "spdxElementId": "child-1.0.0",
  "relatedSpdxElement": "parent-1.0.0",
  "relationshipType": "DEPENDENCY_OF"
}

Note how the second example swaps the place of the parent/child and switches the relationship type from "DEPENDS_ON" to "DEPENDENCY_OF".

Unfortunately, not all of the SPDX-supported relationship types have a matched inverse. Specifically, OPTIONAL_DEPENDENCY_OF and DEV_DEPENDENCY_OF have no matching type which would allow the relationship to be reversed (HAS_OPTIONAL_DEPENDENCY and HAS_DEV_DEPENDENCY would make sense, but aren't supported in the SPDX spec).

In order to consistently represent ALL of the different relationships and ensure that the supplied type properly describes the direction of the relationship, we're going to swap the position of the parent/child nodes in the relationship (spdxElementId will always reference the child, while relatedSpdxElement will always reference the parent) and exclusively use the child-to-parent relationship type labels: DEPENDENCY_OF, DEV_DEPENDENCY_OF, OPTIONAL_DEPENDENCY_OF, and PREREQUISITE_FOR.

References

Fixes #6867

[maxhbr]

Thank for reviving our contribution https://github.com/npm/cli/pull/6868/files.

CC: @antonbauhofer

[wraithgar]

Thanks @bdehamer @maxhbr and @antonbauhofer!