feat!(v2): csv - validate license URL and guess more if invalid

[Bobgy]

Fixes #73

Assumption: the license URL we want to collect is always publically accessible
If there are concerns with this assumption, we can discuss several options:

• hide the feature under a flag
• enable validation by default, but provide a flag to disable this feature. Note we will be releasing v2, so we can consider making a breaking change if that's the default behavior we prefer.