Picking up dependencies license info

[ariel11]

Hi, the tooling is including license info from dependency/third party notice files in the "declared" field - see https://clearlydefined.io/definitions/gem/rubygems/-/nokogiri/1.13.9/1.13.9.

This is incorrect. The "declared" field should only be the top level license for that package.

[qtomlinson]

The root cause for this is where ScanCode result is parsed (ScanCodeSummarizer). There is no package level license information, so license information for top level files is used to derive the declared license. is_license_text is true for LICENSE-DEPENDENCIES.md, and therefore the licenses matched are used as the declared license. In contrast, is_license_text is false for LICENSE.md. Need to recheck this issue after ScanCode upgrade.