add top-level SPDX license tag