Introduce `external_licenses` for prioritised license lookups + consume licenses from SBOMs

Closes #223

See merge request !162