[New Feature]: Validate the manifest License field against the SPDX License List and suggest SPDX identifiers

Nobody has claimed this yet.

### Description of the new feature/enhancement

When a manifest PR sets the `License` field to a value that looks like it should be an SPDX license but isn't an exact SPDX short identifier, the validation pipeline should post a **non-blocking suggestion** on the PR recommending the correct identifier from the [SPDX License List](https://spdx.org/licenses/). If the value is already a valid SPDX identifier — or is clearly a custom/proprietary license not in the list — no action is taken.

This came out of microsoft/winget-cli#3840 and pairs with the documentation update tracked in #408101.

### Proposed technical implementation details (optional)

In the manifest validation stage, compare the `License` value against the current SPDX License List (short identifiers + full names):

- **Exact SPDX short identifier** (e.g., `MIT`, `Apache-2.0`) → pass silently.
- **Close but not exact** (e.g., `MIT License` → `MIT`, `Apache 2.0` → `Apache-2.0`, `GPLv3` → `GPL-3.0-only` / `GPL-3.0-or-later`) → add a **suggestion** comment on the PR proposing the SPDX identifier. Non-blocking (does not fail validation).
- **No confident match** (custom/proprietary text) → no comment.

Keep the SPDX reference data current (e.g., sourced from the published SPDX license list).

*Created with GitHub Copilot.*

Start at the manifest validation stage and trace how validation results are posted to pull requests. Review the SPDX License List as the reference for exact identifiers, full names, and possible suggestions. Done means valid identifiers pass silently, confident near-matches receive non-blocking suggestions, and custom license text receives no comment.

Written by the indexing model from the issue text.