Detect licenses from Maven pom.xml comments

[chrisrueger]

Description

Fat/uber JAR scans could miss Maven licenses when embedded META-INF/maven/**/pom.xml files omitted <licenses> and only documented licensing in XML comments. This change adds an offline fallback that extracts license signals from POM comments before attempting parent POM resolution.

Disclaimer Note on my use of AI: I used Copilot to come up with this PR.
Take it as a base for discussion. I am not experienced with go (comming from the Java world), but I managed to do some some step debugging in VSCode. I will run it against our own project where I identified the issues with the pom.xml
I have no clue how bad / sloppy this go code is but I will try to be helpful comming up with a better solution with help you.
For example I wonder if the regex parsing of the license is already solved in the codebase somewhere and if this PR reinvents the wheel. Just let me know or use the PR as base.

• Comment-based license fallback

  • Preserve raw normalized POM XML during parse
  • Extract licenses from XML comments via:
    • SPDX identifiers
    • well-known license names
    • SPDX-known license URLs

• Resolution order

  • Keep structured <licenses> as the first and authoritative source
  • Only use comment extraction when direct POM licenses are absent
  • Run comment fallback before parent-POM traversal

• Scope control

  • Accept only recognized license URLs
  • Ignore unrelated URLs in non-license comments to avoid false positives

<!--
Oracle licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
-->

Type of change

• New feature (non-breaking change which adds functionality)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections
• This code was generated using AI (original PR Detect Maven licenses from embedded POM comments chrisrueger/syft#1 )

Issue references

Fixes #5248

Summary (Copilot)

This pull request enhances Maven POM license detection by extracting license information from XML comments when structured license data is missing. It introduces a new parser for license comments, updates the main parser logic to use it, and adds comprehensive tests to ensure accuracy and preference for structured data when available.

License extraction improvements:

• Added a new function ExtractLicensesFromComments in comment_license_parser.go to detect and extract SPDX license IDs and URLs from XML comments in POM files, using regex patterns and mappings to known licenses.
• Updated pomProjectByParentPath in archive_parser.go to enrich missing license data by extracting licenses from XML comments if the structured <licenses> block is empty or missing.

Testing and validation:

• Added unit tests for the comment license extraction logic in comment_license_parser_test.go, covering detection, ignoring non-license URLs, and preferring structured licenses over comment-based detection.
• Added an integration test to archive_parser_test.go to verify that license extraction from comments works as expected within the archive parsing workflow.

Internal refactoring:

• Refactored POM XML parsing in pom_parser.go to read the entire file content for charset detection and to facilitate comment-based license extraction. [1] [2] [3]