spdx::v2_3 Patterns to work with SPDX 2.3 documents. annotation artifactof checksum creationInfo external-document-ref external-ref extracted-license-info file package packageVerificationCode predicate range range_ptr relationship relationship-type snippet spdx_ref statement SPDX 2.3 in-toto attestation