feat: integrate with deps.dev

https://deps.dev/ - is an open source handled by google, which contains data on packages.
it also includes data on licenses, which not always can be extracted in syft.
my suggestion is to integrate with deps.dev and use this information to fill missing licenses of packages.
it can support: npm. go, maven, pypi, nuget & cargo.

as far as i can see, it is an open-source that grant can use - https://github.com/google/deps.dev?tab=Apache-2.0-1-ov-file#readme

let me know what do you think :)

Start by reading the linked deps.dev project and its license-data documentation, then compare its support for npm, Go, Maven, PyPI, NuGet, and Cargo with grant's existing license scanning. Done means grant can use deps.dev data to fill licenses that Syft does not provide for supported packages, with the integration scope and behavior agreed.

Written by the indexing model from the issue text.