In queries to report licensing data, we should prioritise the data
inserted into `external_licenses`, whether it's parsed by DMD, or has
provided by the user, as it is assumed that `external_licenses` is more
reliable.

We need to handle the cases where one or both tables have the data,
preferring `external_licenses`, as well as avoid returning any data when
both tables are absent.

This also amends how we retrieve data for policy evaluations, where we
need to make sure we add a per-dependency `group by`s as we're now doing
a `group_concat`, and otherwise we'll get invalid results. We want to
make sure the lack of licenses does not cause any issues with lookups,
as a dependency is still valid if no licensing data is made available.