Explicit --licenses=false enables license scanning

Summary

--licenses is a hybrid Boolean/list flag, but explicitly setting it to false still enables license scanning.

The custom value accepts false as a Boolean value, while downstream code uses only cmd.IsSet("licenses") to populate ScannerActions.ScanLicensesSummary. Because IsSet records flag presence rather than its Boolean value, both --licenses=true and --licenses=false enable the feature.

Current main reproduced at 43026d7a28e5a8ad52c7b4ba3b62047fbf52ad31.

Minimal reproduction

go run ./cmd/osv-scanner scan source \
  --offline \
  --licenses=false \
  ./cmd/osv-scanner/scan/source/testdata/locks-many/package-lock.json

Actual result:

cannot retrieve licenses locally
exit status 127

Expected result:

--licenses=false should leave license scanning disabled, so it should not trigger the offline/license incompatibility.

Impact

This affects generated CI commands and wrapper scripts that emit explicit Boolean assignments. A configuration intended to disable license scanning can unexpectedly enable a network-backed scan or fail in offline mode.

Root cause

allowedLicencesFlag.Set handles false but does not preserve whether the value is enabled. GetCommonScannerActions then sets ScanLicensesSummary from cmd.IsSet("licenses").

The IsBoolFlag comment already states that the flag supports enable/disable values, so the current result is inconsistent with that contract.

Suggested fix

Track the enabled state in allowedLicencesFlag, use that state when building ScannerActions, and add focused tests for unset, implicit true, explicit true, explicit false, and allowlist values.

I searched existing issues and pull requests and did not find this behavior reported. If this approach looks valid, please assign the issue to @Muszic and I can submit the focused fix with regression tests.