Replace deprecated documentDescribes with DESCRIBES relationships

[gyanranjanpanda]

Fixes #1958

Summary

Replaces the deprecated documentDescribes field with DESCRIBES relationships in SPDX SBOM generation, as recommended by the SPDX 2.3 schema.

Changes

• Removed documentDescribes field from SPDX output
• Added DESCRIBES relationships to the relationships array
• Maintained backward compatibility for reading old SPDX documents
• Updated test expectations and test data files

Implementation

The SPDX 2.3 schema explicitly marks documentDescribes as deprecated:

"documentDescribes" : {
  "description" : "DEPRECATED: use relationships instead of this field.",
  "deprecated": true,
  "$comment": "This field has been deprecated as it is a duplicate of using the SPDXRef-DOCUMENT DESCRIBES relationship"
}

This implementation follows the spec recommendation by using DESCRIBES relationships where:

• spdxElementId: SPDXRef-DOCUMENT (the document ID)
• relationshipType: DESCRIBES
• relatedSpdxElement: The root package SPDX ID

Backward Compatibility

The fix maintains backward compatibility:

• Old SPDX documents with documentDescribes can still be parsed
• New SPDX documents use DESCRIBES relationships
• No breaking changes to existing code

Verification

Ran verification script:

./verify_fix.sh

Output:

✅ PASS: documentDescribes removed from test data
✅ PASS: DESCRIBES relationships present
✅ ALL CHECKS PASSED

Testing

• Updated test_spdx_document_as_dict to expect DESCRIBES relationships
• Updated test_spdx_document_from_data with backward compatibility test
• Updated test data files to use new format
• All existing tests pass