Point to spdx.org/licenses in license field docs

I expected the comment about the whitelist to say where you could find the whitelist. This mirrors the information given in the error message if you specify an invalid license identifier.