Add SPDX schema validation in tests

[mprpic]

See #977 (comment)

Tests that generate an SBOM can use https://pypi.org/project/spdx-tools/ to validate the generate SBOM to ensure it complies with the SPDX 2.3 (or w/e other version we support) spec.