Conan: Get real provenance data

[fviernau]

The VCS location of several Conan dependencies point to repositories which contain only recipes used to publish these packages on Conan Central, but not the actual source code of the packages.
As result the actual sources are not being scanned, see e.g. [1,2,3].

[1] https://bintray.com/conan/conan-center
[2] https://bincrafters.readthedocs.io/en/latest/
[3] https://github.com/bincrafters/conan-protobuf

[sschuberth]

Some news about ConanCenter (not "Central"): https://blog.conan.io/2020/01/13/New-Conan-Center-Improves-Search-Discovery.html

[sschuberth]

See the Recipe and Sources in a Different Repo docs for details.

[sschuberth]

Looks like we might be able to get the source artifact from conandata.yml, see e.g. https://github.com/conan-io/conan-center-index/blob/94f7d4a880470c3d6218d0e3f9b6c8ab869e6063/recipes/openssl/3.x.x/conandata.yml