feat: aggregate vendored-crate licenses into an accurate SPDX License: tag #3516

Part of: #3511

User Story

As a Fedora packager and as a downstream consumer of the OpenShell RPM, I want the package's License: tag to accurately reflect every license actually shipped in the binary, so the package is legally accurate and passes Fedora's licensing review.

Problem Statement

openshell.spec currently sets License: Apache-2.0 — OpenShell's own license — but the binaries statically bundle ~600 vendored Rust crates under a mix of licenses (MIT, BSD variants, MPL-2.0, Unicode-3.0, ISC, etc.). %cargo_license/%{cargo_license_summary} already generate a LICENSE.dependencies report, but nothing reconciles that report into the spec's License: field.

Impact / Why This Matters

Fedora's Licensing Guidelines require the License: tag to be an SPDX expression covering every license present in the binary package, not just the top-level project's own license. An inaccurate License: tag is a hard blocker in Fedora package review, and any crate license not on Fedora's allowed-license list needs a separate Fedora Legal conversation before the package can be accepted.

Proposed Design

Consume %cargo_license's per-crate license output and reduce it to a deduplicated SPDX expression as part of the source-generation script, so the aggregated license expression is computed at the same time the vendor tarball is produced, rather than hand-maintained.

Acceptance Criteria

• License: tag (per subpackage as needed) is a correct SPDX expression representing the union of all shipped licenses
• Any vendored crate license not on Fedora's allowed-license list is identified and flagged for a Fedora Legal review
• A repeatable process (script or documented workflow) exists to re-check license aggregation whenever Cargo.lock changes, so this doesn't silently go stale

Alternatives Considered

• One-time manual audit, hand-patch the License: tag — rejected as a long-term approach; it will drift out of sync silently as dependencies change across releases.
• Leave License: as just Apache-2.0 — rejected outright; this is a licensing-accuracy problem independent of Fedora, not just a Fedora-review nicety.