Add a new Java configuration option to recursively search parent poms…

[coheigea]

… for licenses

Part 2 of #2103

#2228 added the ability to read a license from a parent pom in a remote repository like Maven Central. However that PR did not find the license when the license was embedded in a parent pom greater than one level up.

This PR introduces a new Java config option "max-parent-recursive-depth" which defaults to 5. When "search-maven-for-licenses" is enabled, it will recursively go through the parent poms up to "max-parent-recursive-depth" to find a license.

With this PR Syft can now successfully find licenses for:

• https://repo1.maven.org/maven2/org/opensaml/opensaml-core/3.4.6/
• https://repo1.maven.org/maven2/org/apache/directory/api/api-ldap-extras-util/2.0.0/

[spiffcs]

Thanks for the update @coheigea! I'm going to add a unit test here exercising the online behavior with a httptest.NewServer that way we have coverage for the previous state of requesting licenses from maven, as well as coverage of recursing to higher poms.

[spiffcs]

I'm going to make a small change to this PR - we're going to remove the more specific

java:
    search-maven-for-licenses: true

In favor of a master top level switch

use-network: true

[kzantow]

LGTM -- nothing blocking, but a few suggestions

[spiffcs]

@kzantow @wagoodman

After getting some feedback about adding the top level option of use-network I've factored in a breaking change in this PR. Users who might be using the golang config will need to explicitly enable use-network for that option to still be usable.

It's unclear to me of the primacy of the options in this case:

Below is the breaking change where users would need to flip the switch on to preserve golang option:

global use-network: false, golang remote search: true => false
global use-network: unset(defaults to false), golang remote search: true => false

[coheigea]

Thanks a lot @spiffcs for whipping my PRs into shape :-)

[spiffcs]

After more thought, We've decided that adding use-network at the top level here leads to too many small breaking changes going forward. The best course of action is to rename the nested config value from search-maven-licenses => use-network. This does not break any behavior of other catalogers. It also tees up the java options for the future when we start work on the external-sources epic of work. This field is unlikely to be renamed when we start building in the master on/off network switch for syft runs.