fix(spdx): guard against panic on empty license expressions

[sl4x0]

Overview

Fixes #2968

osv-scanner scan --licenses <allowlist> panics with index out of range when any scanned package has an empty license field. An empty license string reaches spdx.Satisfies("", allowlist): the tokenizer produces zero tokens, and tokens.next() dereferences ts.tokens[0] without a bounds check, terminating the whole scan.

Details

Two changes in internal/spdx/satisfies.go:

1. nextAndIsNextNextValid now returns an error when the token stream is exhausted instead of calling next() on an empty list, so an empty expression can never reach the index-out-of-range dereference. This is the root-cause guard (peek() already protected itself; next() did not).
2. Satisfies handles empty/whitespace-only expressions explicitly, returning false, nil so an empty license is treated as "not satisfied by the allowlist" and recorded as a violation (via pkg/osvscanner/vulnerability_result.go) rather than aborting the scan.

Regression tests:

• internal/spdx/satisfies_test.go: empty ("") and whitespace-only (" ") license expressions added to TestSatisfies, asserting they evaluate to not-satisfied without an error (these panicked at HEAD).
• pkg/osvscanner/vulnerability_result_internal_test.go: TestBuildVulnerabilityResultsWithEmptyLicense drives a package with Licenses: []string{""} through buildVulnerabilityResults with a MIT allowlist and asserts the empty license is reported as a violation and the scan completes.

Testing

• Reproduced the panic at HEAD with go test ./internal/spdx -run TestSatisfies before the fix.
• go test ./internal/spdx/... ./pkg/osvscanner/... passes after the fix (including the new regression tests).
• go vet ./internal/spdx/... ./pkg/osvscanner/... reports no issues.
• go build ./... succeeds.

Checklist

• I have signed the Contributor License Agreement.
• I have read the CONTRIBUTING guide, and understand when to open a pull request
• I have run the linter using ./scripts/run_lints.sh.
• I have run the unit tests using ./scripts/run_tests.sh.
• I have made my commits and PR title follow the Conventional Commits specification.

[G-Rath]

can you tone the comments down a bit? we don't need to be describing the past behaviour because that's what git and commit messages are for

[sl4x0]

Note on the checklist: the linter (./scripts/run_lints.sh\ / golangci-lint v2.11.4) flags 19 files in the \osvscanner\ package as gofmt-unformatted on my Windows checkout, including files this PR does not touch (e.g. \pkg/osvscanner/stats.go, \pkg/osvscanner/vulnerability_result.go). Root cause is git's CRLF autocrlf conversion on Windows, not the diff. I verified the changed files (and an untouched control file) are gofmt-clean by running gofmt on LF-normalized copies, and CI on Linux will confirm.