Add OpenDocument Spreadsheet (ODS) support

[bact]

Using SODS library https://github.com/miachm/SODS as suggested here spdx/tools-java#60 (comment)

Implement org.spdx.spreadsheetstore.ods package, a Apache POI adapter for SODS. Then use this with existing spreadsheet generation logic.

Due to SODS limitation, all datetime formats will be mapped to "YYYY-MM-DD" -- this will only affect the rendering. The underlying datetime value will still kept precise, including time (hours, minutes, etc).

The testSerializeOds() is copy of testSerialize().

[goneall]

I did a quick review and it looks good so far. Thanks @bact !

I noticed the dependency uses the Unlicense, which should be compatible with Apache - so we're fine there.

No CVE's or security vulnerabilities reported from the dependency.

The adapter to POI looks like a good approach. I wonder if this my be valuable as a contribution to the upstream SODS project since there may be other projects mixing POI and SODS. The date format or any other SPDX specifics would need to be localized - but it looks like most of the code would be useful outside the SPDX context.

I'll do another, more thorough review after catching up.

[bact]

Think about the SODS contribution too, probably as an optional layer since to include this adapter as a default will probably in a way against their lightweight approach. (update: put a question here miachm/SODS#107)

I'm now looking at how to better deal with data format in SODS. This one should go to SODS directly (see miachm/SODS#108).

[bact]

I noticed the dependency uses the Unlicense, which should be compatible with Apache - so we're fine there.

Will put a notice somewhere on the license.

[goneall]

Will put a notice somewhere on the license.

I checked the upstream POM file and they do not use the SPDX standard license references, so the SPDX file won't pick up the unlincense.

I created an issue (miachm/SODS#109) and a PR in the upstream project. If/when that is merged and released, the SPDX file will contain the correct license information and we won't need to add additional notices.

[goneall]

Finished a second pass - overall, looks good.

The only possible issue is the SPDX SBOM generated will include a "NOASSERTION" license for the dependency until the upstream POM file license information is addressed.

I think we can go ahead and merge and address the license information in a future update.

[bact]

The only possible issue is the SPDX SBOM generated will include a "NOASSERTION" license for the dependency until the upstream POM file license information is addressed.

I think we can go ahead and merge and address the license information in a future update.

Maybe we can later add SODS license info in the NOTICE file, like this one:

https://github.com/spdx/spdx-online-tools/blob/main/NOTICE