Convert License tag to SPDX identifiers
Examined the source code and see most of the library is under
LGPL-3.0-or-later, but sha1 in external/ is under BSD-3-Clause and
unity in external/ is under MIT.
Signed-off-by: David Cantrell <dcantrell@redhat.com>