Support syntax-only SPDX expression parsing

[andrew]

ParseStrict validates identifiers against the SPDX list bundled by
github/go-spdx. Callers using another pinned identifier source can reject a
well-formed expression when the two data versions differ.

Add a parsing mode that checks SPDX expression grammar without requiring bare
license and exception identifiers to exist in the bundled list. An API that
accepts a caller-supplied identifier validator would also solve the problem.
Keep the current ParseStrict behaviour.

git-pkgs/licenses needs this for SPDX-License-Identifier tags. It can parse
the expression first, then resolve identifiers against its pinned ScanCode
corpus.

Cover these cases:

• A well-formed identifier absent from the bundled list succeeds in the new
  mode and fails in strict mode.
• Operators, parentheses, WITH, LicenseRef-*, and DocumentRef-* produce
  the same AST in both modes.
• Malformed expressions fail in both modes.