SPDX expressions

There is a lot of projects (especially in rust ecosystem) that use dual licenses like `MIT OR Apache-2.0` which requires [SPDX license-expressions](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/) to define. But currently copywrite support only single SPDX IDs.