Capture file licenses

[nscuro]

We don't currently scan the files of a module for licenses.
As pointed out in the article below however, it is totally possible that some files are licensed differently than the module.
A simple suggested solution was to scan the first X lines of a file for the SPDX-License-Identifier field.

This was part of the feedback in https://zt.dev/posts/analysis-cyclonedx-gomod-sbom/