Update vendored license JSON files to 3.28.0

[pmonks]

Currently Spdx-Java-Library vendors license metadata files from SPDX license list v3.26.0. It would be handy to update this to the latest version (v3.28.0, at the time of writing).

More generally, perhaps vendoring should be done automatically as part of the library's release process?

[goneall]

More generally, perhaps vendoring should be done automatically as part of the library's release process?

Absolutely - something I've been wanting to do for a while.

In fact, there is a lot of the release process currently done manually we could automate.

An alternative to vendoring the license data would be to separate out the license list data into a separate Jar file.

There is a related request to publish the license list data as an independent jar file and publishing to Maven Central.

This could be automated in the LicenseListPublisher or in a CI in the license-list-data repo.

We could then just reference the latest version.

[pmonks]

Oh yeah a separate JAR is a great idea - it means consumers can pick and choose for themselves how large the JARs in their classpath get.