Some license identifiers are ambiguous (e.g. "GPL3"). The SPDX license
identifiers avoid this by providing standardized and unique identifiers
(e.g. "GPL-3.0-only" or "GPL-3.0-or-later" for the previous example).

Because SPDX short-form identifiers are also both human- and
machine-readable we should recommend them in the documentation.

More information (advantages, details, etc.) can be found here:
- https://spdx.dev/resources/use/#identifiers
- https://spdx.dev/ids/

Fix #7905.

This is regression test for #7573

Share common code to extract the `variables` kwarg in
declare_dependency() and pkg.generate().

wraps from subprojects are now merged into the list of wraps from main
project, so they can be used to download dependencies of dependencies
instead of having to promote wraps manually. If multiple projects
provides the same wrap file, the first one to be configured wins.

This also fix usage of sub-subproject that don't have wrap files. We can
now configure B when its source tree is at
`subprojects/A/subprojects/B/`. This has the implication that we cannot
assume that subproject "foo" is at `self.subproject_dir / 'foo'` any
more.

Allow blocking/forcing automatic subproject search