Currently the CDX.Builders.ComponentBuilder.makeComponent() supports detection of license.

Legacy packages might use the licenses instead.
Proposal: support that legacy format when it comes to license detections.

based on https://github.com/SchemaStore/schemastore/blob/master/src/schemas/json/package.json