Inconsistency in normalize when '+' is present in an invalid license identifier

[qtomlinson]

The output for SPDX.normalize('mit AND Junk') is 'MIT AND NOASSERTION'.
In comparison, the output for SPDX.normalize('mit AND Junk+') is 'NOASSERTION'.

The expected output for SPDX.normalize('mit AND Junk+') should be 'MIT AND NOASSERTION'

[qtomlinson]

This is the root cause for NOASSERTION declared license for the following cases:

• https://clearlydefined.io/definitions/debsrc/debian/-/python-msgpack/1.0.3-1 (problem parsing Apache-2.0 OR GPL-2+)
• https://clearlydefined.io/definitions/debsrc/debian/-/python-requests-oauthlib/1.3.0+ds-0.1 (problem parsing ISC AND GPL-3+)