Validate license field against the SPDX identifier list

Uses a new 'spdx-licenses' gem for the list, and returns an error if this
recommendation isn't met.

The Puppet Forge uses the SPDX list to validate known licenses when scoring
the quality of metadata files.

https://github.com/puppetlabs/puppet-docs/pull/414 introduced this to the
module publishing documentation.
I definitely consider it a recommendation, not a requirement. We will happily accept modules published to Forge without their license metadata matching an identifier from SPDX but we will dock the metadata quality score by a tiny amount.