Remixware v0.5.0

• Licence detection no longer reads a licence as one that asks less of
  you. The SIL Open Font License (1.0 and 1.1) was read as MIT-0, which
  asks for nothing; it is now OFL, a weak copyleft. A BSD text whose third
  clause says "may not be used to endorse or promote" (go-difflib's
  wording) was read as BSD-2-Clause; it is BSD-3-Clause. The Functional
  Source License (read as MIT or Apache-2.0) is recognised as
  source-available, Sleepycat (read as BSD-3-Clause) as copyleft, and
  Creative Commons texts of any version keep their NonCommercial,
  NoDerivs and ShareAlike terms. A permissive text with terms of its own
  on top (the complete source must be made available, as in TOSL and
  TMate, or the software isn't licensed for nuclear or military
  facilities) is LicenseRef-Unrecognised instead of its base licence,
  and so is a grant that keeps its notice in other words (TU-Berlin-2.0,
  read as 0BSD).
• A copy under an unrecognised licence now needs its notice as well as a
  review: until the notice is kept it's attribution-missing, which
  fails check. Before, it was only review, which passes by default.
• Licence files named after licences (LICENSE-MIT, LICENSE-APACHE) are a
  choice only when nothing says otherwise: a short file that names them
  for different parts ("src/ is under LICENSE-MIT. cli/ is under
  LICENSE-GPL.") makes them all apply, and GPL and LGPL files together are
  never a choice. A short file offering them for the whole project with
  "or" ("licensed under the MIT license (LICENSE-MIT) or the Apache License
  2.0 (LICENSE-APACHE)") is read as the choice it is, not as a licence of
  its own.
• remixware deps reads Cargo.lock (versions 3 and 4, and older files
  without a version). With --online it downloads each added or updated
  crate's .crate file and reports a build script or a procedural macro,
  which run code when the crate is compiled, as install-script. Crates
  from git or another registry count as install-script, since they
  can't be looked up, and a crate whose source changes at the same
  version is not-checked.
• With --online, each added or updated Go module's zip comes from the Go
  module proxy, and a module that compiles C with cgo or links .syso
  objects on Linux, macOS or Windows gets the new status native-code.
  It reports without failing unless deps.fail_on names it; the allow-rule
  key native_code: true accepts it. Every run's Checks: block and JSON
  have a fourth check, native-code.
• --crates-url and --go-proxy point those lookups at a mirror. Allow
  rules take cargo/ names, compared as crates.io compares them.
• Every text of the SPDX License List was read with the new detection
  (scripts/spdx-corpus.sh, test/results/licences/spdx-corpus.txt): of
  794, none is read as a licence that asks less than it does.