Adjust Grant policy to suppress expected Alpine license findings for AWF squid image - #51094

The daily container image scan is flagging ghcr.io/github/gh-aw-firewall/squid:0.27.44 with a large set of license-policy violations, largely from expected Alpine base/dependency licenses and metadata identifiers (including sqlite-libs blessing). This change narrows the noise by aligning Grant policy with the expected license surface of the squid image.

• Policy alignment for Alpine/AWF squid licenses

  • Expanded .grant.yaml allowlist to include the license IDs currently reported for the squid image’s base/dependency stack (GPL/LGPL family, MPL-2.0, X11, Zlib, curl, and related identifiers observed in Grant output).

• Known-license handling for distro metadata

  • Set require-known-license: false while keeping require-license: true to permit intentional non-standard identifiers (for example blessing) without disabling license presence enforcement.

• Resulting behavior

  • The squid image scan no longer emits license-policy violations for the expected Alpine package set, while policy enforcement remains active for missing licenses.

# .grant.yaml
require-license: true
require-known-license: false

allow:
  - MPL-2.0
  - X11
  - Zlib
  - curl
  - blessing
  - GPL-2.0-only
  - GPL-2.0-or-later
  - GPL-3.0-or-later
  - LGPL-2.0-or-later
  - LGPL-2.1-only
  - LGPL-2.1-or-later
  - LGPL-3.0-only
  - LGPL-3.0-or-later

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.27.44 #51022