SPDX is not compliant with NTIA requirements when `LicenseRef-XXX` does not appear in

[kikofernandez]

Unrecognized license reference: LicenseRef-wxwindows-free-doc. license_expression must only use IDs from the license list or extracted licensing info, but is: Apache-2.0 AND LicenseRef-wxwindows-free-doc

From ntia-checker --file bom.spdx.json

[kikofernandez]

Depends on aboutcode-org/scancode-toolkit#4136