added SPDX license lookup for single-scanner results