Improve Maven package (POM) declared license detection

The goal of this ticket is to improve maven package license detection across the board. While scancode-toolkit's maven package detection basics are OK, there a few repeat cases where license information is not properly gathered from maven package metadata (e.g. the POM mostly, though we could also consider gradle definition and a few more). Usually this is because a `declared_license` value found in the pom.xml contains things we did not expect (like a URL) or is vague. There is no encoding standard in Maven to document the license, therefore there are many variations.

Resolving this would likely require a mix of:
- adding new license detection rules to scancode,
- adding new and improved code to handle the specific patterns of license,
- creating new license mappings
- and possibly working with upstream maintainers to improve their license declarations.

The approach should be to start with a complete data set of all package manifests (pom.xml) and find patterns of license issues and establish the baseline, possibly helped by heuristics, classifiers and ML if needed. The end results should be a significant improvement to the license detection quality for the maven packages.

One possibility could be to fetch many POMS with bigquery: https://opensource.googleblog.com/2017/03/operation-rosehub.html
Or just fetch them from maven central

See also https://github.com/nexB/scancode-toolkit/issues/1525

There are also other related ticket for other package types such as:
- https://github.com/nexB/scancode-toolkit/issues/2412 for RPM that has some detailed examples
- https://github.com/nexB/scancode-toolkit/issues/2487 for PyPI
- https://github.com/nexB/scancode-toolkit/issues/2487 for npm