fix(SpdxDocumentFile): Ensure to collect issues from external doc refs

Before, issues from external document refs, which could not be mapped to
a `packageId`, failed to be added as issue in the ORT result.
Add these missing transitive issues, by explicitly check for any issues
that are not related to known packages.

Signed-off-by: Marcel Bochtler <marcel.bochtler@bosch.com>

plugins/package-managers/spdx/src/main/kotlin/SpdxDocumentFile.kt

@@ -525,7 +525,7 @@ class SpdxDocumentFile(
             scopeDependencies = scopes
         )
 
-        return listOf(ProjectAnalyzerResult(project, packages))
+        return listOf(ProjectAnalyzerResult(project, packages, transitiveDocument.getIssuesWithoutSpdxPackage()))
     }
 
     /**

plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt

@@ -133,6 +133,15 @@ internal data class SpdxResolvedDocument(
         return pkg
     }
 
+    /**
+     * Retrieve the issues from [issuesByReferenceId] that are not associated with [any package][packagesById]. These
+     * issues can be related to general issues within the SPDX document.
+     */
+    fun getIssuesWithoutSpdxPackage() =
+        issuesByReferenceId.mapNotNull { (id, issue) ->
+            if (packagesById[id] == null) issue else null
+        }
+
     /**
      * Return the local definition file in which the package with the given [identifier] is declared. If the package
      * cannot be resolved or if it has not been declared in a local file, return *null*.