What would you like to be added:
With the recent announcement Anchore Enterprise is now SPDX 3 Ready, support for SPDX 3.0.1 would be beneficial to have in syft.

Why is this needed:
With SPDX 3.0.1 generally available now, it would be nice to have support through syft as well.
The German guidance for Cyber Resilience also requires SPDX 3.0.1 or CycloneDX 1.6:

Additional context:

#1683 (comment)