Prefer spdx_expression over spdx_identifier in license scanning

What does this MR do and why?

With v3 ingestion (!250674 (merged)), a package version can be linked to identifier license rows and expression license rows at the same time. Showing both to the scanner would be wrong: an expression such as GPL-2.0 OR MIT exists precisely to qualify the bare identifiers, and reporting the identifiers alongside it would let a denylist policy fire on a license the expression escapes.

This MR makes the read path prefer expressions: when any of a component's license rows carry an expression, only the expressions are reported; otherwise behavior is unchanged from today. Expressions also get no spdx.org URL, since those pages only exist for single identifiers.

References

• Closes #606525 (closed)
• Related to &22880 (v3 license expression ingestion)
• Write path: !250674 (merged), cutover: #606527 (closed)

How to set up and validate locally

1. Ingest v3 license data containing expressions (see !250674 (merged)'s validation steps)
2. Generate a dependency scan / license scanning report for a project using an affected package
3. Components whose package carries an expression report the expression string, with no URL; identifier-only packages are unchanged

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.