Explicit --licenses=false enables license scanning

## Summary

`--licenses` is a hybrid Boolean/list flag, but explicitly setting it to false still enables license scanning.

The custom value accepts `false` as a Boolean value, while downstream code uses only `cmd.IsSet("licenses")` to populate `ScannerActions.ScanLicensesSummary`. Because `IsSet` records flag presence rather than its Boolean value, both `--licenses=true` and `--licenses=false` enable the feature.

Current `main` reproduced at `43026d7a28e5a8ad52c7b4ba3b62047fbf52ad31`.

## Minimal reproduction

```sh
go run ./cmd/osv-scanner scan source \
--offline \
--licenses=false \
./cmd/osv-scanner/scan/source/testdata/locks-many/package-lock.json
```

Actual result:

```text
cannot retrieve licenses locally
exit status 127
```

Expected result:

`--licenses=false` should leave license scanning disabled, so it should not trigger the offline/license incompatibility.

## Impact

This affects generated CI commands and wrapper scripts that emit explicit Boolean assignments. A configuration intended to disable license scanning can unexpectedly enable a network-backed scan or fail in offline mode.

## Root cause

`allowedLicencesFlag.Set` handles `false` but does not preserve whether the value is enabled. `GetCommonScannerActions` then sets `ScanLicensesSummary` from `cmd.IsSet("licenses")`.

The `IsBoolFlag` comment already states that the flag supports enable/disable values, so the current result is inconsistent with that contract.

## Suggested fix

Track the enabled state in `allowedLicencesFlag`, use that state when building `ScannerActions`, and add focused tests for unset, implicit true, explicit true, explicit false, and allowlist values.

I searched existing issues and pull requests and did not find this behavior reported. If this approach looks valid, please assign the issue to `@Muszic` and I can submit the focused fix with regression tests.