feature: raise issue when package is labeled as X license, but source header shows Y

Grant has the ability to show the license declared for a package as surfaced by syft.

Syft should also be able to communicate to consumers if a declared license is different from one found in the header of the source files. This would allow grant to flag packages with conflicting statements for the user in their evaluation policy.

No files, tests, or entry points are named. Start by tracing how grant consumes Syft's declared-license data and source-header findings, then determine where conflicting values are surfaced. Done means consumers can detect when the declared license differs from the source header license.

Written by the indexing model from the issue text.