Add CI test to check SPDX licenses are up-to-date

Currently, it is a manual process to check that the list of SPDX licenses represented by `licenses/spdx/BUILD` are up-to-date.

Instead, add a CI test that checks what we have against the authoritative source and fails if we are more than some threshold behind.

See PR review comment: https://github.com/bazelbuild/rules_license/pull/17#discussion_r789099505

Start with licenses/spdx/BUILD and the linked PR review comment to understand the current license list and the requested check. Identify the authoritative source and an acceptable lag threshold, then add a CI test that compares them and fails when the list is too far behind.

Written by the indexing model from the issue text.