At ROSCon I talked to @nuclearsandwich and @clalancette. This is my summary what we agreed to do:
Yes, the REP change was accepted in the TSC.
I would like to merge this integrating ros_license_linter.
But there are problems because:
a) This must increment the package.xml schema version.
b) @clalancette wants to do other changes then, too.
So, the solution was to change the tooling such that it
a) differentiates between package.xml versions (not requiring the new attributes introduced by REP change),
b) And it never cause bloom to fail.
These changes are now implemented on our side.

As an update: We think, we can get rid of the dependency on spdx-tools (https://github.com/boschresearch/ros_license_toolkit/blob/63c7406866a5f81eee1457922a6b17fb6b0fd2df/pyproject.toml#L31) but we will probably have to keep the dependency on scancode-toolkit. What are the next steps, then?