CSVAnalyzer can't handle spdx expressions

[neubs-bsi]

Situation

If one enters an SPDX Expression into any of the license columns in the CSV File, the string gets directly mapped onto a license. Hence statements like: ( Apache-2.0 AND MIT ) would not be resolved correctly.
This issue is partly related to #409

Acceptance Criteria

• Licenses are correctly mapped onto a LicenseStatement
• SPDX Expression are supported by the CSVAnalyzer

Definition of Done

• Acceptance criteria fulfilled
• A test case is created to reproduce the bug
• A PR is created, the CI infrastructure reports green, the bug test case proves that bug is fixed
• The PR is reviewed and approved
• No TODOs left in the code unless explained in the ticket, if something else is still open, this is summarized in a comment in the issue
• Documentation is updated