chaoss metrics: OSS compliance and security

[mpadge]

https://chaoss.community/kb/metrics-model-oss-project-viability-compliance-security/

• [ ] OpenSSF Best Practices
• [ ] Licensing
  • License Coverage
  • OSI Approved Licenses
  • Licenses Declared
• [ ] Defect Resolution Duration
• [ ] Libyears
• [ ] Upstream Code Dependencies