Handle SPDX identifier-list version skew in tag matching

[andrew]

SPDX tag matching currently calls spdx.ParseStrict. Its accepted identifiers
come from the SPDX data bundled by github/go-spdx, while identifier rewriting
uses the separately pinned ScanCode corpus. A new SPDX identifier can therefore
exist in the corpus and still be rejected before the resolver sees it.

After git-pkgs/spdx#24 provides syntax-only parsing or caller-supplied
validation, parse tag expressions with that API and resolve their bare license
and exception identifiers against the embedded ScanCode mapping.

Keep the existing outcomes for the other cases:

• Malformed expressions produce no tag match.
• Bare identifiers absent from the ScanCode mapping produce no tag match.
• Valid LicenseRef-* values produce unknown-spdx.
• Rewritten expressions continue to use ScanCode keys.

Add a test with an identifier accepted by the ScanCode resolver but absent from
the strict SPDX list so the version-skew path stays covered.