Validate license field against the SPDX identifier list

Uses a new 'spdx-licenses' gem for the list, and returns an error if this
recommendation isn't met.

The Puppet Forge uses the SPDX list to validate known licenses when scoring
the quality of metadata files.

https://github.com/puppetlabs/puppet-docs/pull/414 introduced this to the
module publishing documentation.
FWIW, I was thinking about this a bit more. If the intent of metadata-json-linter is to encourage consistent, complete and high-quality module metadata for all Forge modules, it makes sense to me for this to error out. In the future, conformance to license identifiers by SPDX may enable a module to participate in a search filter for license.