fix: guard against panic on malformed SPDX license expression

[arpitjain099]

What

spdxexp.ExtractLicenses can panic (nil pointer dereference) on some malformed SPDX expressions. The one I hit is an expression with a dangling opening parenthesis, for example MIT AND ( (also plain (, (((((, MIT OR ().

handleSPDXLicense in grant/license.go calls it and only handles the returned error, not a panic. Because SBOM license fields are decoded straight into pkg.License.SPDXExpression without re-validation (syft's json decoder copies the field through as-is), a single malformed license value in an input SBOM takes down the whole scan rather than being skipped.

Fix

Wrap the call in a small safeExtractLicenses helper that recovers from the panic and returns an error, so the existing error branch falls back to treating the value as a non-SPDX license. Minimal change, existing behavior for valid expressions is unchanged.

syft guards its own call to this same parser for exactly this reason, see the recover in license.ParseExpression and anchore/syft#1837. This just brings grant in line.

Test

Added TestConvertSyftLicenses_MalformedSPDXExpressionDoesNotPanic, which drives the real ConvertSyftLicenses entry point with the malformed expressions above and asserts they fall back to a non-SPDX license instead of panicking.

Before the guard (reverting just the one call back to spdxexp.ExtractLicenses):

--- FAIL: TestConvertSyftLicenses_MalformedSPDXExpressionDoesNotPanic/MIT_AND_(
panic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]

After:

--- PASS: TestConvertSyftLicenses_MalformedSPDXExpressionDoesNotPanic
ok      github.com/anchore/grant/grant

go build ./... and go test ./grant/ both pass.

This is a robustness fix for malformed input, not a security report.