Allow for custom non SPDX-expression licenses (including content)

[HeyeOpenSource]

Description

Implements support for custom licenses.
Should probably be reviewed by @wagoodman and / or @spiffcs.

• Fixes License files which do not match an SPDX expression are erroneously handled as 'unlicensed'. #3412
• Potentially fixes feat: dpkg license improvement for non SPDX licenses #3090

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections
• I have run make test locally without receiving any failures
• 'Validations' workflow returns no errors

[wagoodman]

If we add support for this we should make this configurable. It could be a simple on/off (collect or do not collect contents) but there is some argument for more options here. Specifically, when we can get the ID from contents and we have a high degree of confidence that it matches then including the contents is redundant / not necessary (one of multiple possible middle of the road options).

I think the default for this option should either be "off" or the middle of the road option.

[HeyeOpenSource]

My implementation only ever fills the Contents field if a non-empty file identified as potential license file (by name) exists and no SPDX-expression can be determined for it with the required confidence.
Otherwise the status quo implementation is retained.

Hence I would assume that the option as you describe it is currently "middle of the road" by default. 😉

[HeyeOpenSource]

I would advocate for a later implementation of the configurability, as my current implementation mitigates the fact, that packages with an identified (but non-SPDX-expression-compatible) license file will be erroneously handled as unlicensed. (cf. #3412)

[HeyeOpenSource]

The Validations workflow finally throws no more errors at me. 👍
cf. Validations #22

[HeyeOpenSource]

The implementation of this pull request mitigates the fact, that packages with an identified (but non-SPDX-compatible) license file will be erroneously handled as unlicensed. (cf. #3412)