`Bom.validate()` misses invalid license constellations

[jkowalleck]

data models allow licenses to be a set of license expressiosn and other licenses.
then it comes to serialization, this is an invalid constellation. invalid in XML and in future JSON.

see CycloneDX/specification#205