The duplicate-key invariant test pinned floating dependency versions
(@radix-ui/react-slot 1.2.4) that drift out of the generated license
data on every bump. Derive the multi-version package and its versions
from licenseEntries so the test asserts the dedup invariant, not a
specific version string.

Signed-off-by: Christian Stewart <christian@aperture.us>