Validate license field against the SPDX identifier list

Uses a new 'spdx-licenses' gem for the list, and returns an error if this
recommendation isn't met.

The Puppet Forge uses the SPDX list to validate known licenses when scoring
the quality of metadata files.

https://github.com/puppetlabs/puppet-docs/pull/414 introduced this to the
module publishing documentation.
That's a fair point, and I've wondered about "shoulds" in other areas of metadata.json, which aren't checked yet.

I could make it not raise an error, then add a fail-on-warnings mode like puppet-lint?  (Personally, that's what I'd use.)

The only difficulty then is how to ensure modules can enable it easily.. puppet-lint reads an .rc file which is great, as it means predefined tasks (e.g. https://github.com/puppetlabs/puppetlabs_spec_helper/commit/a1995ff35b1f375be067bf8561b9ba1596910f77#diff-c7beddb7111031927788e851096dc9deR222) continue to just work.