spdx-whitelisted

test whether SPDX expressions satisfy license whitelists