Make Cargo targets inherit package licenses

[pbestler]

This change makes cargo target subcomponents inherit the license defined by their package, include the license and 'license-file' content from the workspace.

Regression fixtures and tests cover package SPDX licenses, worspace licenses, license files, and both library and binary targets.

For us at liebherr it solves the following problem: In the sbom we were missing the license from subcomponents if they refer the ones from the workspace. These subcomponents can be libraries or binaries.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 35 complexity · 2 duplication

Metric	Results
Complexity	35
Duplication	2

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[pbestler]

Friendly ping on this one.

To recap: cargo target subcomponents currently end up without any license when the package inherits it from the workspace. This makes the targets inherit the license from their package, including license-file content. There are fixture-based regression tests for package SPDX licenses, workspace licenses and license files, each covering both a lib and a bin target.

Some context on why this matters to us: we use cargo-cyclonedx at Liebherr to generate the SBOMs for our Rust components, and our workspaces declare the license once at the workspace root. Every subcomponent in the resulting SBOM then comes out without a license, which is exactly the field our downstream license review needs. We are running this patch out of tree for now and would much rather be on upstream.

No conflicts with main and CI is green. Happy to rebase or split this up if that makes review easier.

@Shnatsel, would you have a moment to take a look?

[lfrancke]

I'm sorry for the silence here. I have it on my todo list to go over the open PRs here but it'll take me a bit more time.