licenses: support compound SPDX expressions in the allow list

[MavenRain]

Closes #827.

Each entry of the [licenses] allow list may now be either a
single SPDX licensee (the historical shape) or a compound SPDX
expression with OR/AND operators. A compound entry covers a
dependency only when the dep's expression remains satisfiable
under every interpretation that satisfies the compound entry,
i.e. for every licensing choice the project commits to offering
its downstream. This is strictly stronger than the per-licensee
semantics that the existing flat-list shape provides.

Concretely, allow GPL-2.0-only OR GPL-3.0-only covers a dep
licensed GPL-2.0-only OR GPL-3.0-only but rejects a dep
licensed GPL-2.0-only alone, since incorporating the latter
would force the project to drop the GPL-3.0-only option from
the compound it commits to its users.

Implementation: enumerate the 2^n subsets of the compound
allow's requirements (n capped at 16), filter to subsets in
which the allow expression evaluates true, and verify the dep
expression also evaluates true in every such world.

Limitation: spdx::Licensee::satisfies does not currently
relate the canonical-form identifiers GPL-2.0-only and
GPL-2.0-or-later, so a dep licensed GPL-2.0-or-later is
not yet covered by an allow expression that only mentions the
-only forms. Pinned as a regression guard in tests; lifting
the limitation is upstream spdx work.

Tests: six unit tests on the coverage helper covering the
motivating compound match, lone-disjunct rejection, unrelated
AND-dep rejection, AND covers OR-dep, single-licensee
passthrough, and the or-later limitation.