Adds dependency review action to verify allowed licensed dependencies

[ericwb]

This change will add a new action to scan the dependency's licenses for any that may not be allowed for this project.

The pip-licenses command was run to get a dump of all the licenses associated with this repo and put into the allow-licenses list. Normally, you might only want to use deny-licenses list, but for packages like Redis, there is no defined SPDX identifier for it.

Note: this list will require future maintenance as dependencies get added that are not already in the allow list.

https://spdx.org/licenses/
https://github.com/raimon49/pip-licenses

Related to issue #2901

All Submissions:

• Have you followed the guidelines stated in CONTRIBUTING.md file?
• Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

New Feature Submission:

• Does your submission pass the tests?
• Have you linted your code locally prior to submission?

Changes To Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?

After these steps, you're ready to open a pull request.

a. Give a descriptive title to your PR.

b. Describe your changes.

c. Put `closes #XXXX` in your comment to auto-close the issue that your PR fixes (if such).

[ericwb]

I should also add that there is a transitive dependency on package docutils which does have a GPL license associated with it. This can potentially affect the Reflex Hosting Service if that code is not also open sourced and the code is linked.

From pip-licenses:
docutils 0.21.2 BSD License; GNU General Public License (GPL); Public Domain; Python Software Foundation License

https://pypi.org/project/docutils/

[ericwb]

So docutils is a transitive dependency of twine.

├── twine [required: >=4.0.0,<6.0, installed: 5.0.0]
│   ├── readme_renderer [required: >=35.0, installed: 43.0]
│   │   ├── docutils [required: >=0.13.1, installed: 0.21.2]

Although you probably wouldn't consider this a derivative work, so that might just be fine.

Before merging this PR, I think disallowing GPL should be considered. It could affect any private code of Reflex that "statically links" to code in this repo (copyleft). But it could also affect stakeholders using Reflex that don't wish to open source their UI.