We found few missing SPDX identifiers, see the comment https://github.com/ARMmbed/mbed-os/pull/12480#discussion_r382099030 .

Some files in cbor folder have SPDX but some don't. The files we have in Mbed OS are being fixed here https://github.com/ARMmbed/mbed-os/pull/12480/commits/b9e00de2d956e428e10950ea514442a45f058df7 (see the files in the folder components/TARGET_PSA/services/attestation/qcbor)