Add license checks

[timkpaine]

Load a lock (local --lock <file> or registry --env --registry, same loader as sbom/manifest), group its conda packages by declared license, and print a deterministic report:

$ nepenthe license --lock research.lock
0BSD (1)
  liblzma 5.8.3
Apache-2.0 (4)
  grpcio 1.73.1
  libabseil 20250512.1
  libgrpc 1.73.1
  openssl 3.6.3
BSD-3-Clause (7)
  ...

--deny <license> (repeatable) flags any package whose license matches — case-insensitively, exact match against the conda license string — and exits non-zero, listing offenders. A build-time policy gate:

$ nepenthe license --lock research.lock --deny 0BSD
...
denied licenses found:
  liblzma 5.8.3 (0BSD)
error: 1 package(s) violate the license deny policy   # exit 1

Note: the conda license field is free-form (SPDX-ish, sometimes compound, sometimes empty). This reports it verbatim and matches deny entries exactly/case-insensitively — a pragmatic gate, not a full SPDX-expression evaluator. Packages with no license group under UNKNOWN.

[github-actions]

Test Results

181 tests  +3   181 ✅ +3   4s ⏱️ ±0s
  5 suites ±0     0 💤 ±0 
  2 files   ±0     0 ❌ ±0 

Results for commit d2c7c88. ± Comparison against base commit e431b65.