Handle dual license

[spoorcc]

Some projects such as TF-PSA-Crypto have a single license file that contains 2 licenses, infer license could be improved to detect this.

[spoorcc]

When a license file is detected but the license cannot be determined, the SBOM currently omits the licenses field.

Propose to:

Explicitly set license to NOASSERTION (or "Unknown")
Add an evidence entry indicating a license file was found but could not be classified

This improves transparency and downstream compliance analysis

[spoorcc]

For components where no license file is present, propose to:

Set licenses to NOASSERTION or "Unknown"
Add an evidence entry indicating that no license file was found

This ensures transparency and supports downstream compliance checks.