mark bundled content with SPDX file

The SPDX file contains hand-written metadata about source URL, version,
authors, and license.

There are two missing pieces in HTTP module:
- bootswatch theme - I could not find what theme we ship, maybe it is
  based on one of bootswatch themes but heavily modified
- selectize.js source does not match respective files in upstream but
  contains minor changes

I will deal with these in later commits.