Check the project_license against the list of SPDX IDs when validating