feat: allow subpackage copyright metadata

[officialasishkumar]

Melange Pull Request Template

Functional Changes

• This change can build all of Wolfi without errors (describe results in notes)

Notes:
Adds subpackage-level copyright metadata support so subpackages can declare distinct licenses. When a subpackage does not define copyright metadata, package emission and SPDX generation continue to use the origin package metadata. This closes #1007.

Validation:

• go test ./pkg/config ./pkg/build ./pkg/build/sbom/spdx
• go test ./...

Wolfi-wide build was not run locally.

SCA Changes

• Examining several representative APKs show no regression / the desired effect (details in notes)

Notes:
Not an SCA behavior change.

Linter

• The new check is clean across Wolfi
• The new check is opt-in or a warning

Notes:
Not a linter change.