spdx30_tasks: fix missing SPDX runtime dependencies

spdx30_tasks: fix missing SPDX runtime dependencies

The runtime dependsOn relationship entries between software_Package
is missing from the generated SPDX files.

Remove the subpkgdata lookup as the final pkg_name is already resolved
by collect_package_providers().

Rename variables to avoid shadowing the 'dep' variable and to make it
explicit which package/pkg name is being used.

Signed-off-by: Pascal Eberhard <pascal.eberhard@se.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>