Update dependency org.spdx:spdx-tools to v2.2.7 [SECURITY] (hughtest)

[mend-for-github-com[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.spdx:spdx-tools (source)	2.2.1 -> 2.2.7

---

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

This PR upgrades org.spdx:spdx-tools to avoid a critical vulnerability in log4j. For details about this problem, read here.

---

Release Notes

spdx/tools (org.spdx:spdx-tools)

### [`v2.2.7`](https://togithub.com/spdx/tools/releases/tag/v2.2.7): Version 2.2.7 of the SPDX Java Tools (Legacy) [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.6...v2.2.7) Updates the Log4J version to version 2.17.0 to resolves a severe denial of service vulnerability CVE-2021-45105 ### [`v2.2.6`](https://togithub.com/spdx/tools/releases/tag/v2.2.6): Version 2.2.6 of the SPDX Tools (Legacy) [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.5...v2.2.6) #### What's Changed - Resolves critical security issue in log4j library CVE-2021-44228 - Resolves moderate security issue in log4j library CVE-2021-45046 - Resolves minor security issue in Guava library CVE-2018-10237 - Resolves minor security issue in Guava library CVE-2020-8908 - Update POM file to deploy to sonatype by [@​goneall](https://togithub.com/goneall) in [https://github.com/spdx/tools/pull/275](https://togithub.com/spdx/tools/pull/275) - Bump commons-compress from 1.19 to 1.21 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/spdx/tools/pull/277](https://togithub.com/spdx/tools/pull/277) - Bump jsoup from 1.11.3 to 1.14.2 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/spdx/tools/pull/279](https://togithub.com/spdx/tools/pull/279) - Fix spelling of anonymous by [@​goneall](https://togithub.com/goneall) in [https://github.com/spdx/tools/pull/280](https://togithub.com/spdx/tools/pull/280) - Update log4j to version 2.16.0 and guava to version 29.0-jre by [@​goneall](https://togithub.com/goneall) in [https://github.com/spdx/tools/pull/285](https://togithub.com/spdx/tools/pull/285) **Full Changelog**: https://github.com/spdx/tools/compare/v2.2.5...v2.2.6 Note that there is a re-designed version of this tool: [tools-java](https://togithub.com/spdx/tools-java) ### [`v2.2.5`](https://togithub.com/spdx/tools/releases/tag/v2.2.5): Version 2.2.5 of the SPDX Tools (Legacy) [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.4...v2.2.5) This release includes the following fixes: - [#​273](https://togithub.com/spdx/tools/issues/273) Resolves an issue introduced with the latest release of the License List - [#​269](https://togithub.com/spdx/tools/issues/269) Parses out Boolean types from the RDF when parsing the RDF/XML format Note that there is a re-designed version of this tool: [tools-java](https://togithub.com/spdx/tools-java) ### [`v2.2.4`](https://togithub.com/spdx/tools/releases/tag/v2.2.4): Version 2.2.4 of the SPDX tools [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.3...v2.2.4) Add CrossRefs to support LicenseListPublisher enhancements to URL handling. Resolve issue [#​260](https://togithub.com/spdx/tools/issues/260) Various bug fixes. ### [`v2.2.3`](https://togithub.com/spdx/tools/compare/v2.2.2...v2.2.3) [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.2...v2.2.3) ### [`v2.2.2`](https://togithub.com/spdx/tools/releases/tag/v2.2.2): Version 2.2.2 of the SPDX tools [Compare Source](https://togithub.com/spdx/tools/compare/v2.2.1...v2.2.2) Release 2.2.2 of the SPDX tools. Includes support for additional cross reference fields required by the LicenseListPublisher and additional minor fixes.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box