Omit SourceLicense tag when using vendor tarball
When using vendored dependencies, the licenses in the sources will
typically match the licenses in the binaries. In this scenario the
SourceLicense tag can be omitteed since it should match the License tag.