Resolve tension between source location and source license information

Some versioned packages point back to a repositories that do not have version tags and so we cannot say with certainty at what commit the package was built. This has issues for reproduciblity of builds, as well as license information.

As part of our curation process, when these types of packages do not have license information, we look to the source as having license information. Similarly, source license obligations typically flow through to the binary. Thus, having a "fuzzy" understanding of the source location would be helpful to understand more about the licensing of a package.

Thinking about this will also impact how we think about our curation process.