Pull out loose parser as a separate package

[kemitchell]

There have been a number of calls to loosen up the parser to admit invalid identifiers:

#16, #24, #25, jslicense/spdx-satisfies.js#7

I'd like to create a new package that parses SPDX expressions without validating identifiers, then rewrite this package to run that parser and validate the identifiers.