fix(copyright): extract structured contributor credits

[mstykow]

Summary

• Treat contributor, contributors, and x_contributors arrays as explicit authorship credits in validated JSON and YAML metadata.
• Preserve one author record per structured declaration, including object entries with a name field.
• Exclude credit-looking values in code/schema structures and package inventories while retaining credits under document metadata wrappers.

Issues

• Covers: follow-up findings from False-positives when comparing provenant with scancode-toolkit output #1391

Scope and exclusions

• Included: array-valued author/contributor credits in package-like JSON and YAML metadata plus structural cleanup of code/example and package-inventory fields.
• Explicit exclusions: free-form contributor prose, embedded multi-document test formats, and package-parser party output.

How to verify

• Scan Perl 5.38.4 with provenant --copyright --json out.json perl-5.38.4. Relative to fix(copyright): extract YAML author arrays #1407, this adds 16 explicit contributor records across eight CPAN metadata files with no removals and no copyright/holder changes. The InfoZIP 3.0 control scan is unchanged in all three fields.
• Inspect cpan/CPAN-Meta/corpus/CL018_yaml.meta: Provenant recovers seven explicitly listed contributors that ScanCode omits.
• Inspect the full-tallies fixture's scan/package.json: its root npm contributor roster is now reflected in file, global, key-file, facet, detail, and parent-directory author tallies; nested package inventory authors remain excluded.

Intentional differences from Python

• Provenant includes explicit extension contributor arrays and emits entries independently. ScanCode misses these credits in the benchmark fixtures and joins other structured lists into one value.

Follow-up work

• Created or intentionally deferred: embedded structured documents, explicit prose author sections, and malformed/template author cleanup remain in later stacked branches.

Expected-output fixture changes

• Files changed: tallies.expected.json, tallies_details.expected.json, tallies_key_files.expected.json, and tallies_by_facet.expected.json under testdata/summarycode-golden/tallies/full_tallies/.
• Why the new expected output is correct: the fixture contains a root npm contributors array with 291 accepted independent names. The updated author-only facets record those intentional detections and their derived tallies; structural tests separately prove nested package inventories do not leak authors.

[mstykow]

@greptileai

[mstykow]

@greptileai review