fix(SpdxDocumentFile): Ensure to collect issues from external doc refs

Before, issues from external document refs, which could not be mapped to
a `packageId`, failed to be added as issue in the ORT result.
Add these missing transitive issues, by explicitly check for any issues
that are not related to known packages.

Signed-off-by: Marcel Bochtler <[email protected]>

plugins/package-managers/spdx/src/main/kotlin/SpdxDocumentFile.kt

@@ -525,7 +525,7 @@ class SpdxDocumentFile(
             scopeDependencies = scopes
         )
 
-        return listOf(ProjectAnalyzerResult(project, packages))
+        return listOf(ProjectAnalyzerResult(project, packages, transitiveDocument.getIssuesWithoutSpdxPackage()))
     }
 
     /**

plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt

@@ -133,6 +133,18 @@ internal data class SpdxResolvedDocument(
         return pkg
     }
 
+    /**
+     * Retrieve the issues from [issuesByReferenceId] that are not associated with any package [packagesById]. These
+     * issues can be related to general issues with the SPDX document.
+     */
+    fun getIssuesWithoutSpdxPackage(): List<Issue> {
+        return issuesByReferenceId.filterKeys { referenceId ->
+            packagesById.keys.none { packageId ->
+                packageId.startsWith("$referenceId:")
+            }
+        }.values.toList()
+    }
+
     /**
      * Return the local definition file in which the package with the given [identifier] is declared. If the package
      * cannot be resolved or if it has not been declared in a local file, return *null*.