feat: [five-c] Compliance extended report set

[tdruez]

Issues

• Issues: five-c: Create extended report set #415

Changes

• Product license compliance export

Adds a per-product export of the license distribution already shown on the Compliance tab. For each license associated with the product's packages, the export includes the SPDX key, short name, internal key, number of packages using it, and the compliance alert level (error/warning). Useful for sharing license posture with legal or compliance reviewers outside the application, and for feeding downstream audit tooling.

• Product security compliance export

Adds a per-product export of the vulnerabilities affecting the product's packages. For each vulnerability, the export includes the vulnerability ID, aliases (CVE, GHSA, PYSEC, etc.), summary, risk level and score, exploitability, weighted severity, number of affected and fixed packages within the product, and the reference URL. Useful for vulnerability triage reports, VEX-adjacent workflows, and security audits.

Both available as the following formats:

• Comma-separated Values (.csv)
• JSON (.json)
• OpenDocument (.ods)
• Microsoft Excel (.xlsx)
• YAML (.yaml)

Screens

Available from the "Download" icon in both panel header of the "Product > Compliance tab"