Provide explanation for invalid license identifier (#6200)

After discussion in #hackage it seemed prudent to add some minimal
explanation of what a valid SPDX identifier might look like in the error
message.