Add get_licenses tool with SPDX and copyleft enrichment

[christian-andersson]

Summary

Adds a new get_licenses MCP tool that looks up the declared license for one or many packages in a single call, enriched with SPDX metadata and copyleft classification from a baked-in dataset.

• Tool: batch input {packages: [{registry, package, version?}]}. Each result carries a status (found / not-declared / registry-unsupported / error), the raw license string verbatim, and a spdx[] array with licenseId, name, isOsiApproved, isDeprecated, category, isCopyleft, plus a top-level isCopyleft shortcut. Works across 11 of 13 registries; go and docker short-circuit as registry-unsupported without a network call.
• Dataset: data/licenses.json merges the SPDX License List (CC0-1.0) with ScanCode LicenseDB categories (CC-BY-4.0). Both sources and their full attribution strings are embedded in sources[] and echoed on every response so downstream consumers carry the CC-BY-4.0 attribution. Manual refresh via deno task update-licenses.
• Parser: LicenseRegistry.parse tolerates free-form strings — splits OR / AND / , / / / WITH for dual-licensed packages, matches case-insensitively by SPDX ID and by full name (so "MIT License" resolves like "MIT"), and deduplicates repeated tokens.
• Registry extensions: Maven now parses the POM <licenses> block (<name> preferred, falls back to <url>, joins multiple with , ). JSR fetches the per-version detail endpoint where the declared license lives. Both reuse existing per-package caches.
• Plumbing: --allow-read propagated to start / dev / test tasks, the CI workflow, and the CLAUDE.md pre-push checklist, since the tool reads the baked dataset at runtime.

Test plan

• deno fmt --check && deno lint && deno check main.ts && deno test --allow-net --allow-read — all four CI gates pass (194 tests).
• Call get_licenses from an MCP client with a mix of registries (npm, maven, jsr, cargo, pypi, go, docker) and confirm status is correct for each.
• Hit a dual-licensed package (e.g. cargo / serde → "MIT OR Apache-2.0") and confirm spdx[] returns both entries with isCopyleft: false.
• Hit a copyleft package (e.g. an LGPL/GPL artifact on Maven) and confirm top-level isCopyleft: true.
• Run deno task update-licenses and confirm the dataset rewrites cleanly with the new generatedAt timestamp.

🤖 Generated with Claude Code