feat(spdx): Allow LicenseRef- exceptions for licenseInfoInFiles

SPDX v2 does not allow using custom (`LicenseRef-`) IDs as exceptions
and an SPDX expression. Whether / how that could be supported in future
is currently being discussed, see [1].

When the SPDX reporter creates an SPDX document containing `LicenseRef-`
exceptions it crashes due to an exception from
`SpdxExpression.validate()`. The only SPDX V2 compliant options for
preventing that crash are:

1. Come up with a whole new `LicenseRef-` license string which denotes
   to a text containing both, the license and the exception.
2. Allow `LicenseRef-` in the report.

So, this commit implements #2 which is an easy fix, at least for the
short term.

[1] spdx/change-proposal#4

Signed-off-by: Marcel Bochtler <marcel.bochtler@bosch.com>

utils/spdx/src/main/kotlin/model/SpdxFile.kt

@@ -25,6 +25,7 @@ import com.fasterxml.jackson.annotation.JsonProperty
 
 import org.ossreviewtoolkit.utils.spdx.SpdxConstants
 import org.ossreviewtoolkit.utils.spdx.SpdxConstants.REF_PREFIX
+import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 import org.ossreviewtoolkit.utils.spdx.isSpdxExpressionOrNotPresent
 
 /**
@@ -187,7 +188,9 @@ data class SpdxFile(
 
         // TODO: The check for [licenseInfoInFiles] can be made more strict, but the SPDX specification is not exact
         //       enough yet to do this safely.
-        licenseInfoInFiles.filterNot { it.isSpdxExpressionOrNotPresent() }.let {
+        licenseInfoInFiles.filterNot {
+            it.isSpdxExpressionOrNotPresent(SpdxExpression.Strictness.ALLOW_LICENSEREF_EXCEPTIONS)
+        }.let {
             require(it.isEmpty()) {
                 "The entries in licenseInfoInFiles must each be either an SpdxExpression, 'NONE' or 'NOASSERTION', " +
                     "but found ${it.joinToString()}."