Add reusable license check workflow for plugin repos

[snake14]

Description

Adds a reusable workflow (.github/workflows/plugin-license-check.yml) plugin repositories can call to verify their licensing is consistent. It checks that the repository ships a LICENSE/LICENSE.md file matching the license declared in plugin.json, and that source files (*.php, *.js, *.ts, *.vue) carry the matching license header — the GPL header for OSS plugins, the InnoCraft EULA header for premium ones. A file carrying the opposite header fails the check; files with no recognized header are warnings (opt into failing via the fail-on-missing-header input). Repositories can skip files via glob patterns in a .license-check-ignore file, e.g. bundled third-party code or released migrations.

A caller workflow is a few lines (see the README section this PR adds). Piloted on innocraft/plugin-Funnels#289, where it runs green; local runs against LoginLdap and Funnels also caught real wrong-header files, since fixed (matomo-org/plugin-LoginLdap#459). The Funnels pilot pins its refs to this branch and switches to @main once this merges.

Checklist

• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated

[AltamashShaikh]

@snake14 Is this correct ?

  Medium-risk issues

  - Version drift between the reusable workflow ref and the checked-out script source. See .github/workflows/plugin-license-check.yml:11.

[snake14]

@snake14 Is this correct ?

  Medium-risk issues

  - Version drift between the reusable workflow ref and the checked-out script source. See .github/workflows/plugin-license-check.yml:11.

@AltamashShaikh Correct as an observation, but it's the same deliberate trade-off as plugin-phpstan.yml in #44: GitHub provides no context identifying a called reusable workflow's own commit (github.job_workflow_sha evaluates to empty — verified empirically during #44's smoke tests), so the script pin has to be an explicit input. With the @main convention there's no drift; a caller that pins the workflow to a SHA passes the same SHA as script-ref. 5155e11 documents this on the input and adds the explanatory comment to match #44.

[snake14]

Closing as this will go into a new repo.