Add "SourceLicense" to PackageDef

This new field should follow the SPDX standard: https://spdx.org/licenses/