Bug: preserve LicenseRef-* custom license IDs through vg sbom format exports

[vibgrate-team]

Context

Custom LicenseRef-* identifiers are valid in SPDX-oriented inventories. Adjacent SBOM converters have dropped them on format boundaries. vg sbom export should preserve custom license refs across CycloneDX and SPDX outputs when the source graph recorded them — deterministic, no silent strip.

Related but distinct from parse-failure diagnostics for malformed SPDX ids.

What to do

• Audit CycloneDX and SPDX export paths for LicenseRef-* (and equivalent custom license expressions).
• Preserve refs in both formats when present on a component; if a format cannot represent them, emit an actionable warning naming the component — do not drop quietly.
• Add a fixture component with a LicenseRef- and assert round-trip or export stability.

Acceptance

• Custom LicenseRef-* survives export for supported formats
• Unsupported representation yields a visible warning, not a silent omit
• Fixture/test covers at least one LicenseRef
• Deterministic output for fixed input
• DCO sign-off (git commit -s)