Allow any protocol in the download location URL verification

[goneall]

The current download pattern used is:

^(NONE|NOASSERTION|(((git|hg|svn|bzr)\+)?(http:\/\/www\.|https:\/\/www\.|http:\/\/|https:\/\/|ssh:\/\/|git:\/\/|svn:\/\/|sftp:\/\/|ftp:\/\/|file:\/\/|file:\/)?[a-zA-Z0-9\.\-\ \_]+(:[0-9]{1,5})?(\/.*)?)|(git\+git@[a-zA-Z0-9\.\-]+:[a-zA-Z0-9/\\.@\-]+)|(bzr\+lp:[a-zA-Z0-9\.\-]+))$

There is an issue where the s3 protocol is not recognized (see spdx/spdx-gradle-plugin#139).

Perhaps we should allow any protocol - since s3 is not an IANA standard protocol.

[goneall]

From the tools implementers call on 16 Oct. 2024 - general agreement we should allow any protocol.

Additional suggestions from the call:

• RFC 2396 has a regex for URI
• XSD defines ANYURI
• use Apache Validator

[goneall]

Here's the regex from RFC 2396: ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?

[goneall]

Here's the reference to the Apache Validator: https://commons.apache.org/proper/commons-validator/apidocs/org/apache/commons/validator/routines/package-summary.html#other.url