GOAL:

• improve SPDX license expression detection -- incorporate https://packagist.org/packages/composer/spdx-licenses
• have the license model just take what they are given - no validation inside
• factory may validate/check and generate the correct data types: preferred order: SpdxID, Expression, NamedLicense as fallback.
• normalizers need to check for valid SPDX license id, as the model does no longer assert this.