Do no use subprocess for the ScanPackage (scan_package) pipeline

[tdruez]

Using subprocess is problematic for multiple reasons:

• Introduce security issues
• Cannot log the progress
• Cannot catch errors and exceptions while running
• Cannot interact with the running process
• Cannot use mock in the unit test context
• Cannot use the status system to flag and exclude resources from scan
• ....

From #556 (comment)

The underlying issue is that the ScanPackage pipeline depends on a subprocess call to the scancode command.
If scancode fails, there's no easy way to save this as a ProjectError and continue the pipeline run.

A better approach would be to replace this approach with proper API calls, as we did for the Scanners in the ScanCodebase pipeline (For example: get_copyrights, get_licenses, get_package_data)

---

The 2 missing pieces as callable API for the ScanPackage pipeline are:

• --classify: FileClassifier(PostScanPlugin)
• --summary: ScanSummary(PostScanPlugin)

[tdruez]

Following the merge of #855 , we are not relying on a subprocess call anymore as we call directly the scancode.cli.run_scan function.

This is better but there's still the following limitations:

• Cannot catch errors and exceptions while running
• Cannot interact with the running process
• Cannot use the status system to flag and exclude resources from scan