Do periodic license scanning on images and build artifacts

Following on from https://github.com/kubernetes-sigs/cluster-api/issues/9181 there may be a need in CAPI to find a good way to scan for forbidden licenses in our release artifacts - namely our controller images and the clusterctl binaries.

There are a few tools out there that can do such a scan:

Trivy

• Currently used for our code-level license scans on PRs.
• Can run and report without needing a token or integration with an external service.
• Same tooling as we currently use for PRs and for periodic security scans
• Currently detecting GPL licenses in our base image distroless:nonroot. These are not being picked up by the other scanners.

Snyk

• Used for a periodic scan for upstream Kubernetes. The current version of the scan ignores license information.
• Requires a Token, but we might be able to share the one used by Kubernetes or find out where they got theirs from.
• Can be used from CLI with report output to file

Fossa

• Seems to be the preferred tool for CNCF projects
• Requires a Token, but we might be able to get one from the CNCF.
• Requires access to the web service for license scanning and reporting.
• Seems easiest to run using a github action with the key

There's still ongoing conversation in the Kubernetes community about this.

My preference would be to defer the conversation for CAPI until we have some idea of the preferred direction from the community. None of the tools above seem to be a great fit for now. If someone has time to take this on though it could be really helpful for CAPI and the broader community.