Add SPDX headers

[AndyScherzinger]

and a Github action to check for compliance on PRs

Also some files seems wrongly licenses as AGPL3-only instead of AGPL3+ @julien-nc