The allow-licenses list is expected (and documented) to be a list of SPDX license IDs (LicenseRefs are also valid). If someone puts an expression in the list (e.g. "GPL-3.0-only OR MIT"), it should be discarded so that the whole list does not become invalid. Fixes #907