ci: add license compliance check

[wochinge]

Blocked by: #3711

Related Issues

• fixes Dependency license checker with CI step  #1989
• https://github.com/deepset-ai/haystack-hub-api/issues/1271

Proposed Changes:

• check license compliance nightly as well as PRs
• if it fails it will send a Slack notification

How did you test it?

n/a

Notes for the reviewer

Some dependencies were flagged. We should decide how to proceed with them and mark the false alarms as such.

Checklist

• I have read the contributors guidelines and the code of conduct
• I have updated the related issue with new insights and changes
• I added tests that demonstrate the correct behavior of the change
• I've used the conventional commit convention for my PR title
• I documented my code
• I ran pre-commit hooks and fixed any issue

[CLAassistant]

All committers have signed the CLA.

[ZanSara]

It seems like there are 6 packages that needs to be addressed:

1st order:

• quantulum3: core dependency
• rdflib: the only dep of SPARQLWrapper, graph docstore related https://github.com/RDFLib/sparqlwrapper/blob/master/requirements.txt

2nd order:

• from python-docx: core dependency

  • lxml: https://github.com/python-openxml/python-docx/blob/36cac78de080d412e9e50d56c2784e33655cad59/requirements.txt#L3
  • pyparsing: https://github.com/python-openxml/python-docx/blob/36cac78de080d412e9e50d56c2784e33655cad59/requirements.txt#L5

Deep deps

• pygments: deep dependency of streamlit

ui==0.0.0
  ...
  - streamlit [required: >=1.9.0,<2, installed: 1.15.2]
    ...
    - rich [required: >=10.11.0, installed: 12.6.0]
      ...
      - pygments [required: >=2.6.0,<3.0.0, installed: 2.13.0]
      ...

• grpcio: used by pymilvus and ray

Some of these, being second or third order deps, seem hard to avoid. I will determine where they come from and propose a mitigation strategy.