Discard allow list entries that are not SPDX IDs

The allow-licenses list is expected (and documented) to be a list of
SPDX license IDs (LicenseRefs are also valid). If someone puts an
expression in the list (e.g. "GPL-3.0-only OR MIT"), it should be
discarded so that the whole list does not become invalid.

Fixes #907

src/licenses.ts

@@ -29,7 +29,16 @@ export async function getInvalidLicenseChanges(
     licenseExclusions?: string[]
   }
 ): Promise<InvalidLicenseChanges> {
-  const {allow, deny} = licenses
+  const deny = licenses.deny
+  let allow = licenses.allow
+
+  // Filter out elements of the allow list that include AND
+  // or OR because the list should be simple license IDs and
+  // not expressions.
+  allow = allow?.filter(license => {
+    return !license.includes(' AND ') && !license.includes(' OR ')
+  })
+
   const licenseExclusions = licenses.licenseExclusions?.map(
     (pkgUrl: string) => {
       return parsePURL(pkgUrl)