fix: Switch refs for dev and opt dependencies in SPDX sboms

[antonbauhofer]

As pointed out in this comment, the relationships in SPDX sboms are currently incorrect.

In order to keep the directions as intuitive as possible, we leave them as is for dependencies and prerequisites, and only swap the refs for dev and optional dependencies, where it is currently not correct.

Fixes#6867

[maxhbr]

This fixes the issue #6867 (which should still be open)

[wraithgar]

Sorry for the confusion earlier today. I'll let @bdehamer review this

[maxhbr]

Thanks for your support! I think the initial misunderstanding was caused by my imprecise comment on #6801, so I might be to blame for confusion here.

[maxhbr]

@bdehamer : this is still a bug in npm and it would benefit from your review.

[bdehamer]

@maxhbr if SPDX is ok with inverting those relationships for OPTIONAL_DEPENDENCY_OF and DEV_DEPENDENCY_OF, should we just flip them all and switch DEPENDS_ON/HAS_PREREQUISITE to DEPENDENCY_OF/PREREQUISITE_FOR?

This would make the direction of the relationship consistent across all four types (and eliminate some complexity from the implementation).

[maxhbr]

Yes, I agree that this would be an option. We implemented that in https://github.com/npm/cli/pull/6868/files

[bdehamer]

Closing this in favor of #7036 so that we can swap the direction for ALL of the relationship types.