The license is included. To quote the ordering guide
All DNS Security and Secure Internet Gateway core packages include access to download AnyConnect from the Software Download center. AnyConnect makes it easy for customers to roll out Umbrella across roaming devices and also simplifies their journey for migrating to our SIG packages down the line.
The Cisco contract or Subscription ID generated provides access to those with their CCO ID associated, to download AnyConnect only for the purpose of installing the Umbrella module. For all other use cases, such as AnyConnect VPN or other AnyConnect integrations, a separate AnyConnect license is required.
Hope that helps