fix: SPDX relationships in sbom

[antonbauhofer]

This adjusts the relationships in an SPDX sbom, created with npm sbom, to match the explanations at https://spdx.github.io/spdx-spec/v2.3/relationships-between-SPDX-elements/

To reflect the correct directionality, the order of the relationship references is swapped and the following types are changed:
HAS_PREREQUISITE -> PREREQUISITE_FOR
DEPENDS_ON -> DEPENDENCY_OF

Fixes #6867

[wraithgar]

Did you read this conversation?

[wraithgar]

Closing as per the conversation in #6867

[antonbauhofer]

Did you read this conversation?

Yes, the PR is based on this conversation.
As @maxhbr pointed out, "the directionality is implied by the spdxElementId/relatedSpdxElement fields, in combination with the type of the relationship". When checking the relationships with a concrete example, I noticed that some do indeed point in the wrong direction. So, we fix it here.
As @bdehamer pointed out, "many of the types don't have a supported inverse". For that reason, I chose to replace
HAS_PREREQUISITE -> PREREQUISITE_FOR
DEPENDS_ON -> DEPENDENCY_OF
so we can keep the order of the references consistent.

[maxhbr]

@wraithgar : the conversation you linked was not resolved. It was a Problem with the PR that was pointed out, but it got merged without fixing.

My last comment #6801 was probably confusing. I wanted to say that this line is probably correct, but the others are still inconsistent and wrong.