Support SPDX expressions in allow/deny lists

This change updates license validation to support full SPDX expressions
(such as 'EPL-1.0 AND LGPL-2.1') in both allow-lists and deny-lists. This
enables the action to correctly validate packages that declare multiple
licenses using SPDX conjunctions like AND/OR, which are common in complex
open-source projects.

Previously, only simple license identifiers were supported, which caused
multi-licensed packages to be improperly flagged as invalid even when
they matched the intent of the allow-list.

The new logic uses `spdx.satisfies()` to evaluate whether a package’s
declared license satisfies any expression in the allow/deny list, and
comprehensive tests have been added to verify behavior for various SPDX
combinations.

This improves compatibility with projects using compound SPDX license
expressions and ensures more accurate license policy enforcement.

src/licenses.ts

@@ -88,14 +88,20 @@ export async function getInvalidLicenseChanges(
       try {
         if (allow !== undefined) {
           if (spdx.isValid(license)) {
-            const found = spdx.satisfiesAny(license, allow)
+            let found = false
+            for (const allowedLicense of allow) {
+              found ||= spdx.satisfies(allowedLicense, license)
+            }
             validityCache.set(license, found)
           } else {
             invalidLicenseChanges.unresolved.push(change)
           }
         } else if (deny !== undefined) {
           if (spdx.isValid(license)) {
-            const found = spdx.satisfiesAny(license, deny)
+            let found = false
+            for (const deniedLicense of deny) {
+              found ||= spdx.satisfies(deniedLicense, license)
+            }
             validityCache.set(license, !found)
           } else {
             invalidLicenseChanges.unresolved.push(change)