Some packages had incorrect checksums because they needed to be
downloaded from a new place or the package needed tweaking somehow.
These packages to sha256 and the new checksums have been verified by
fetching over https.
- remove the old LGPL license headers from all files in Spack
- add SPDX headers to all files
- core and most packages are (Apache-2.0 OR MIT)
- a very small number of remaining packages are LGPL-2.1-only
