Bump composer/spdx-licenses to 1.3.0