Integrate license policy with pre-cache scanner hooks

[andrew]

The pre-cache scanner hook added in #298 already stages the exact artifact bytes, gives external services a signed fetch URL, and accepts an allow or deny verdict before the artifact becomes visible. A license scanner can use the same boundary to apply operator policy without adding a license policy language to proxy.

Extend the scanner response so a service can return a typed license report alongside allowed, reason, and findings. The report should include a kind, schema version, scanner identity, and JSON data. Existing scanner integrations can omit the new field.

A configured license service should be able to:

• Return allowed: true with a report when it is collecting evidence without enforcing policy.
• Return allowed: false with a safe reason when the artifact violates its configured license policy.
• Use the existing block and fail-open behavior for policy decisions.
• Pass an admitted report to the persistence and presentation work in Persist artifact license reports and expose them in the API and version pages #312.

The scanner group currently combines findings from all services, while the cache path only checks the final verdict and discards successful results. Preserve named results so reports remain associated with the service that produced them and persist them only after the artifact is admitted.

Define and test the waiting behavior for report-only scanners. The current documentation says monitor scanners do not gate the wait, but Group.Scan waits for every scanner goroutine before returning. A report that will be persisted needs a clear completion rule, and a slow report-only service should have an explicit effect on first-download latency.

Cache hits should use the stored report associated with the current artifact digest instead of calling the service again. Existing cached artifacts without reports remain unscanned under the initial scope. The proxy mirror CLI is also outside scope; normal server traffic and mirror API jobs use the configured server pipeline.

Tests should cover an external license service fetching the signed URL, an allow response carrying a report, a policy denial, report-only failure behavior, a scanner timeout, and two scanners returning separate named results. At least one test should enter through a public package download endpoint with a real archive.

Related work:

• Add archive-backed license text to licenses output git-pkgs#328
• Add pre-mirror decision hooks before caching artifacts #155