Use SPDX /Core/Annotation and relationships to record provenance

**What problem does this solve?**

Currently metadata provenance (where we collect/extract metadata from) is recorded in "comment" field, for SPDX 3 SBOM.

**Proposed solution**

SPDX 3 model provides [`Annotation`](https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Classes/Annotation/) that could be use to record provenance of Elements in a more systematic way.

