fix(sbom): component UUID to calc SPDXID's

[DmitriyLewen]

Description

https://github.com/mitchellh/hashstructure doesn't use non-expert fields - https://go.dev/play/p/zfC1E-2wlWi
This is why we don't use UUID to build SPDXID.

This PR:

• use fnv.New64() instead of https://github.com/mitchellh/hashstructure (hashstructure has been archived).
• use only UUID (files still use filepath) to calculate SPDXID.

Related issues

• Close bug(sbom): Duplicate SBOM packages for multi-module pom.xml files #7824

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).