Support parsing: bounded static CMakeLists.txt metadata

[mstykow]

Add support for bounded static parsing of CMakeLists.txt for package metadata and declared dependency intent.

Proposed scope

• top-level literal project() metadata such as name, version, description, homepage URL, and SPDX license when present
• top-level literal find_package() calls as declared dependency intent
• top-level literal FetchContent_Declare() calls as vendored dependency intent
• include(CPack) plus explicit CPACK_* package metadata
• optional tiny same-file constant folding for trivial set(VAR "literal") cases

Explicitly out of scope for the first pass

• include()-driven cross-file evaluation
• wrappers implemented through macro() or function()
• conditionals, generator expressions, toolchain files, dependency providers, and broader variable indirection
• full configure-time resolution of find_package() or FetchContent_MakeAvailable()

Why this is worth tracking

CMake projects are common, but CMakeLists.txt is a dynamic build language rather than a stable manifest format. A bounded static parser could still extract useful package identity and dependency clues without executing CMake, similar in spirit to Provenant's bounded meson.build support.

Related local context

• Existing issue: Support parsing: vcpkg classic-mode ports (portfile.cmake + CONTROL) #63 tracks legacy vcpkg portfile.cmake / CONTROL support, which is CMake-adjacent but not generic CMakeLists.txt parsing.
• There does not appear to be an upstream ScanCode issue or current Provenant issue specifically for generic CMakeLists.txt package parsing.