Capture file licenses

We don't currently scan the files of a module for licenses.
As pointed out in the article below however, it is totally possible that some files are licensed differently than the module.
A simple suggested solution was to scan the first X lines of a file for the `SPDX-License-Identifier` field.

This was part of the feedback in https://zt.dev/posts/analysis-cyclonedx-gomod-sbom/

Start by reviewing the repository's module-scanning flow and the linked CycloneDX analysis article. Determine where file-level license data can be collected, then verify that scanning the first X lines of each file captures SPDX-License-Identifier values while preserving module-level licensing behavior.

Written by the indexing model from the issue text.