fix: use SPDX license URL in published POM

[utkrishtsahu]

Changes

• Updates POM_LICENCE_URL in gradle.properties from the raw GitHub link (https://raw.githubusercontent.com/auth0/JWTDecode.Android/master/LICENSE) to the standard SPDX URL (https://spdx.org/licenses/MIT.html).
• Why: License-scanning tools (e.g. Cash App's licensee) can't recognize the raw GitHub URL, forcing consumers to manually allowlist it. The SPDX URL is auto-recognized as MIT. Fixes Change MIT license url to SPDX url #87.
• No code, API, or license terms change — publishing metadata only. POM_LICENCE_URL is the single source of truth read by gradle/maven-publish.gradle.
• Alternatives considered: PR Fix/spdx license url #107 used an afterEvaluate { pom.withXml { ... } } hook to rewrite the generated POM. That approach was fragile (patched output, not source) and was silently dropped during the Central Portal publishing migration, so 2.0.3 still shipped the old URL. Correcting the property directly is durable and flows through the maintained publishing config.

References

SDK-8760

Testing

Run:

./gradlew :jwtdecode:generatePomFileForReleasePublication

Verify the generated POM at lib/build/publications/release/pom-default.xml contains:

[x] This change adds test coverage

[x] This change has been tested on the latest version of the platform/language or why not

Checklist

[x] I have read the Auth0 general contribution guidelines

[x] I have read the Auth0 Code of Conduct

[x] All existing and new tests complete without errors