An empty string is currently said to be a valid license expression

[Nemo157]

The syntax as defined in "SPDX Specification 2.1 Appendix IV: SPDX License Expressions" does not allow for an empty string, there must be at least 1 license specified.

The current validator allows an empty string. I would be wary of changing this without investigating whether it will affect crates.io, it may be that it is relying on the current behaviour if an empty license field is allowed (I'm not certain whether it is).