[license] Honest conversation about license fetching

[prabhu]

Identifying license information for open-source projects was never a primary objective for cdxgen. The tool does very little to identify licenses, only querying the registry in most cases and only when the FETCH_LICENSE flag is set. This is in no way a fool-proof way of determining licenses. A registry could have an incorrect license for several reasons.

• The license for a particular version could be different from the package
• The project might have a mismatch between the license ID specified in the package manifest and the actual license file presented
• The project might have an incorrect license ID. For example, a developer might claim an MIT license but might have copied Apache-2.0 or GPL files in the project

I wish there were a way to express the confidence and the technique used for license attributes so that the consumer tools can make a better decision regarding this.