[IP] Track all dependencies

[Desplandis]

Context

The purpose of this issue is to track all dependencies (both external and within the tree) and their license. We could then ensure that they are no incompatibilities with the project current licenses (MIT & Cecill-B).

Proposed fix

The osgeo Code Provenance Review provides a good framework to start:

• [ ] List any external components that are included "in the source tree" for the project (e.g. draco in examples/libs/draco used in the examples)
• [ ] List all external dependencies (including devDeps?)

For each of those dependencies, include:

• Library name
• License
• Whether the library licence is compatible with the project
• Whether the library is bundled into the project's releases, or required as an external dependency
• Whether the library is included in the project's code repository
• Issue? (link if issue if one exists)

Template (inspired by the Provenance Review Template):	Library	License	Compatible?	Included in tree?	Issue(s)?	Comments
three	MIT	yes	no	n/a

Maybe we could generate such listing from npm ?