bundle dependency license info

https://github.com/sstadick/cargo-bundle-licenses

tl;dr generate a file that lists all the licenses of deps.

there are so many third party tools that do this that ideally we can leverage the best in class of them to get full coverage for all project types, but it's possible it's also "easy enough" to reimplement given that we are already *excellent* at finding and reading project manifest files and that using that graph as *input* to third party tools might be harder than just reimplementing.

Start by reviewing the referenced cargo-bundle-licenses project and cargo-dist's existing project-manifest discovery and dependency-graph handling. Compare whether an external tool can consume that graph or whether license collection must be implemented directly. Done means generating a file that lists the licenses for all project dependencies with coverage across supported project types.

Written by the indexing model from the issue text.