package-manager open-source-licensing dependency-graph compliance dependencies license spdx copyright hacktoberfest license-management sca license-checking license-scan package-scan copyright-scan ospo oss-compliance sbom cyclonedx sbom-generator