License requirements

[Ulf Adams]

I just wanted to move our requirements from a comment on a closed PR (#6 (comment)) to the bugtracker:

• it didn't collect through output file dependencies (fixed now)
• we have a custom license type that also has attached file references to license and notice files as well as URLs pointing at the original source (this information is required for some cloud marketplace deployments)
• the list of attributes it traverses is too narrow; it's actually hard to come up with a complete list, but here's what we're using for a Java application: "deps", "exports", "jars", "resources", "runtime_deps", "srcs"; for other languages, we may need to collect from even more attributes (e.g., hdrs for C++)
• it doesn't enforce our repo-specific annotation rules: we're enforcing license annotations for all rules under our third_party directory and a subset of external workspaces; some of that is specific to our use case