Open source license risk management