SPDX: revisit `is_expression`

[jkowalleck]

The 9.0.0-dev is_expression is not validating SPDX expressions in general, because verification is done against the scancode license DB that you refused to take as reference.

If you would extend the tests as I did you would see that it is not working as documented in the SPDX spec.
For example, custom LicenceRef-* license references are not considered as correct except those that are listed in Scancode's DB. License item validation happens only against the internal ScanCode DB.

Please look into the function description of Licensing.parse and the code of license-expression in general to see how it works.

Originally posted by @Joerki in #773 (comment)

[jkowalleck]

will add additional tests
and see how the code may be fixed so tests are passing.

---

see drafted tests from #77

[jkowalleck]

closed via #782