Add `.spdx.json` to the list of filetypes for SPDX SBOM targets

[alilleybrinker]

See title. Currently we don't infer anything from this type, so it'll be determined to a repo-type seed. Specifying -t sbom doesn't override, just leads to a conflict between the inference and the specified target type.