Validate license field against the SPDX identifier list

Uses a new 'spdx-licenses' gem for the list, and returns an error if this
recommendation isn't met.

The Puppet Forge uses the SPDX list to validate known licenses when scoring
the quality of metadata files.

https://github.com/puppetlabs/puppet-docs/pull/414 introduced this to the
module publishing documentation.
Should this always fail? The Puppetlabs docs say: `License metadata should match an identifier provided by SPDX.` They've specifically used the word 'should' instead of 'must' but I'm not sure how precise the wording is in that document.