docs: clarified licenses and renamed spdx variable to what it is

The Spdx list is the list of licenses understood by SPDX, not necessarily agreed on
by our team and/or Google. That variable is really a whitelist.

Author: hansl