nixpkgs-clarity: Design and implement Scancode pipeline for single nixpkg

[pombredanne]

A new pipeline designed specifically for Nix packages, that is aware of the conventions, and unwritten community practices in license and origin documentation.

[pombredanne]

Here is a scenario for a dedicated pipeline for nixpkg:

• The ScanCode input should be a nix PURL with type TBD, or some URL?
• The source and binary is downloaded and we run a d2d process between that binary and the source to find any discrepancy
• we also should find the source repo and ensure it matches the sources
• we should run a source code scan for license (scan codebase) and check that licenses match the metadata
• we should also match the source code in the package MatchCode to find borrowed code from a 3rd party

[chinyeungli]

See #2155 for reference on approaches to get packages' metadata

[chinyeungli]

we can use fetchcode to download the source and binary once aboutcode-org/fetchcode#203 is approached and merged