CSAF-2.1: Informative Tests 6.3.17

[rainer-exxcellent]

Please note the refactoring issue: #435

[rainer-exxcellent]

It MUST be tested that the all license identifiers and exceptions are listed either in the official SPDX license identifier list or AboutCode's "ScanCode LicenseDB".

AboutCode license DB:

https://github.com/aboutcode-org
https://github.com/aboutcode-org/scancode-licensedb
https://scancode-licensedb.aboutcode.org/index.json

SPDX license:

https://spdx.org/licenses/
https://github.com/spdx/license-list-data/blob/main/json/licenses.json