feat(dotnet): add license support for NuGet

[DmitriyLewen]

Description

packages.config and packages.lock.json files don't have information about the licenses used.

Add support of *.nuspec files from global packages folder.

notes:

• Currently only the default path and NUGET_PACKAGES environment variable are supported.
• licenseUrl is not supported, because this field has been deprecated.
• license expression only supports

Example:

➜  ./trivy fs -f json --list-all-pkgs ./packages.lock.json 
2023-09-20T13:50:05.734+0600	INFO	Number of language-specific files: 1
2023-09-20T13:50:05.734+0600	INFO	Detecting nuget vulnerabilities...
2023-09-20T13:50:05.734+0600	DEBUG	Detecting library vulnerabilities, type: nuget, path: packages.lock.json
{
  ...
  "Results": [
    {
      "Target": "packages.lock.json",
      "Class": "lang-pkgs",
      "Type": "nuget",
      "Packages": [
        {
          "ID": "Newtonsoft.Json@13.0.3",
          "Name": "Newtonsoft.Json",
          "Version": "13.0.3",
          "Licenses": [
            "MIT"
          ],
          "Layer": {},
          "Locations": [
            {
              "StartLine": 5,
              "EndLine": 10
            }
          ]
        }
      ]
    }
  ]
}

Related issues

• Close feat(NuGet): add license support #5216

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Looks very nice! I left small comments.

[knqyf263]

nit: I prefer the happy path getting aligned to the left edge.
https://medium.com/@matryer/line-of-sight-in-code-186dd7cdea88

Suggested change

	if license := pkg.Metadata.License; license.Type == "expression" && license.Text != "" {
	return []string{license.Text}, nil
	}
	return nil, nil
	if license := pkg.Metadata.License; license.Type != "expression" || license.Text == "" {
	return nil, nil
	}
	return []string{pkg.Metadata.License}, nil

[DmitriyLewen]

Changed in 1d0fed1

[knqyf263]

nit: We might want to aggregate the statements.

Suggested change

	if err != nil {
	if !errors.Is(err, fs.ErrNotExist) {
	return xerrors.Errorf("license find error: %w", err)
	}
	}
	if err != nil && !errors.Is(err, fs.ErrNotExist) {
	return xerrors.Errorf("license find error: %w", err)
	}

[DmitriyLewen]

Right! Thanks! Updated in 1d0fed1.

[DmitriyLewen]

@knqyf263 looks like this PR has not been added to merge queue.
Can you check?

[knqyf263]

CLA assistant didn't work. I opened the following link to trigger it.
https://cla-assistant.io/check/aquasecurity/trivy?pullRequest=5217