Scanning `osv-scanner.json` format does not correctly output spdx

[another-rex]

Scanning osv-scanner.json format does not correctly output with the --format=spdx flag.

Currently no packages will appear, and after #2177 it will show up with the incorrect purl type.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.

[github-actions]

Automatically closing stale issue