SPDX formatting issues

[Madhu173]

There are a bunch of warning with generated spdx files and fails SBOM NTIA minimum element conformance. (https://tools.spdx.org/app/ntia_checker/))

1. licenseDeclared uses & and | between licenses. Where are as the expected usage is AND OR
2. license identifiers are not compatible, might be because of the source itself. For example GPLv2 in generated spdx but expected is GPL-2.0-only
   generates this warning " license_expression must only use IDs from the license list or extracted licensing info"
   3)externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type
   4)externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type