Point to spdx.org/licenses in license field docs

I expected the comment about the whitelist to say where you could find the whitelist. This mirrors the information given in the error message if you specify an invalid license identifier.

I didn't make this a markdown link since it's within markdown within code within markdown, but I'm happy to edit this in any way you see fit.

Thank you!! :heart: