[BUG] Dependency graph API returns null license for all un-pinned version specifiers (e.g. pyproject.toml ranges)

[ppulc]

Describe the bug
The GitHub dependency review API returns "license": null for every package entry that carries a version range specifier (e.g. ^, >=, ~). These entries originate from manifest files such as pyproject.toml (Poetry) rather than the corresponding lock file (poetry.lock). The result is that every such package is flagged as having an unknown license, even for widely-used packages with clearly declared SPDX licenses.

To Reproduce

1. Use a Python project with Poetry (i.e. both pyproject.toml and poetry.lock present)
2. Open a PR that adds or updates any dependency
3. Run actions/dependency-review-action on the PR
4. Observe that all packages sourced from pyproject.toml (with range specifiers like ^2.11.0 or >=23.0) are flagged as unknown license, while the same packages sourced from poetry.lock (with exact pinned versions) resolve correctly

Expected behavior
Packages with version range specifiers should be resolved to their license (e.g. by resolving the exact dependency version against the corresponding lock file).

Screenshots
N/A

Action version
v4, v5

Examples
Raw dependency review API response for a ranged entry from pyproject.toml:

{
  "change_type": "added",
  "manifest": "pyproject.toml",
  "ecosystem": "pip",
  "name": "pydantic",
  "version": "^ 2.11.0",
  "package_url": "pkg:pypi/pydantic",
  "license": null
}