Add THIRD_PARTY_NOTICES.md and a generator for it

[abrarshivani]

Adds THIRD_PARTY_NOTICES.md covering both surfaces of this project, the script
that generates it, and a CI check that fails when deps change without the notices
being refreshed.

Same change already proposed for gpu-operator, mig-parted, k8s-device-plugin,
k8s-driver-manager and nvidia-container-toolkit. This repo is mostly C, so it
needed more than go-licenses.

NOTICE, LICENSE, COPYING and COPYING.LESSER are unchanged.

What to review

70% of the diff is generated. Hand-written:

File	Lines
hack/generate-notices.sh	782
deployments/devel/go.sum	147
Makefile	37
.github/workflows/build.yaml	25
deployments/devel/go.mod	25
deployments/devel/tools.go	25

Generated: THIRD_PARTY_NOTICES.md (2385 lines).

go-licenses is pinned in deployments/devel/, beside the Dockerfile that
already pins the golang version, so dependabot manages both.

How it works

make notices covers two surfaces:

Go, for the src/nvcgo subcomponent. go-licenses save and csv per
platform against its vendored deps, licenses joined, module@version from
src/nvcgo/vendor/modules.txt.

C, for the three build-time dependencies. Versions and URLs are parsed from
mk/elftoolchain.mk, mk/libtirpc.mk and mk/nvidia-modprobe.mk, each tarball
is downloaded at generation time, and the terms are quoted from the archive. The
document's versions are the build's by construction, so they cannot drift.

make notices-check regenerates and diffs, on every build, no path filter.

Implementation notes

• The makefiles are parsed, not invoked. mk/common.mk calls GNU-only
  date -u --iso-8601 and errors on any arch outside x86_64/ppc64le/aarch64, so
  shelling out to make would make the generator unrunnable on a macOS host.
  Only $(VERSION) and $(PREFIX) are expanded, and any surviving $( is
  fatal.
• The three C projects keep their terms in three different places, so one
  rule does not fit. libtirpc ships COPYING, but it names only Bull S.A. while
  the sources carry around 37 further holders, so the per-file notices are
  collected too. elftoolchain ships no LICENSE or COPYING at all, so its
  terms come entirely from file headers. Whole comment blocks are collected, not
  just copyright lines, because BSD and MIT both require the conditions text to
  travel with the notice.
• nvidia-modprobe is declared MIT, not GPL-2.0. Its top-level COPYING is
  GPL-2.0 and covers binaries this repo does not build: mk/nvidia-modprobe.mk
  extracts only modprobe-utils/ and links libnvidia-modprobe-utils.a, and
  those files are individually MIT. Quoting COPYING would have declared GPL-2.0
  over code that is not GPL and is statically linked into a BSD-licensed library.
  The linked subset is also not purely NVIDIA's: it carries IBM, Red Hat and
  Zanoni/Vignatti notices, and pci-sysfs.c says it is based on libpciaccess.
  pkg/rpm/SPECS/libnvidia-container.spec already notes the MIT headers.
• WITH_TIRPC and WITH_LIBELF are rendered as a table grepped from the
  makefiles, not described in prose, so it cannot rot. That grep surfaced a
  third configuration worth knowing about: rhel8 links the system libtirpc via
  -ltirpc without setting WITH_TIRPC.
• LC_ALL=C on every awk, not just sorts and greps. libtirpc-1.3.2's
  src/epoll_sub.c has a Latin-1 comment that aborts macOS awk with a multibyte
  conversion failure. An iconv gate on the composed document fails loudly if a
  future dependency ships a legacy encoding.
• Moved with mv, not cp, so an interrupted run cannot leave a
  half-written file.

Scope

Three C dependencies and five Go license roots.

The new file defers to the existing ones rather than replacing them. LICENSE
governs this project's own code. NOTICE, COPYING and COPYING.LESSER remain
authoritative for the WITH_LIBELF=yes case, where elfutils libelf is linked
dynamically under LGPL, and the new document names that configuration and points
at them.

Also out of scope and stated: other link-time system libraries such as libcap
and libseccomp, host driver components, and build tooling that leaves no code
in the artifacts.

THIRD_PARTY_NOTICES.md is added to DOC_FILES, so it installs beside the
existing four and the rpm subpackages' %license glob picks it up with no spec
change.

Testing

• Determinism. Two runs on macOS and two in golang:1.26.4 all byte-identical,
  sha256 6798827d…. Nothing is cached between runs, so each re-downloads all
  three tarballs.
• Go completeness against go list -deps ./... over three platforms: 11
  expected, 11 present, 0 missing, 0 extra.
• C versions match mk/*.mk for all three, and bumping libtirpc to 1.3.3 in
  the makefile makes notices-check fail. That test fetched 1.3.3 and re-quoted
  it, so it is end-to-end rather than a string comparison.
• Content. 0 Unknown, 0 missing text, 0 unresolved module@version, 8
  sections, fences balanced, valid UTF-8.
• Error paths. Missing input, unreadable modules.txt, a failed tarball fetch,
  an unexpanded make variable, a drifted platform matrix, an unsafe
  LICENSES_DIR, and absent go-licenses. Each exits non-zero with a clear
  message and leaves the committed file untouched.
• Lint. shellcheck clean. make -n confirms the default goal is unchanged.

Two things worth knowing. make notices cannot run on macOS, since
mk/common.mk rejects arm64 at parse time, which predates this change; the
script itself runs there. And SourceForge is slow, so the elftoolchain fetch can
take several minutes. The repo's own make deps already pulls the same URLs, so
this is not new exposure, but CI runtime is worth watching.

Noticed, not fixed here

pkg/rpm/SPECS/libnvidia-container.spec declares GPL-2.0-only in its License:
field, which appears to come from nvidia-modprobe's top-level COPYING rather
than from anything actually linked, and pkg/deb/copyright does not mention
libtirpc at all. Both look like gaps, but correcting a distro package's declared
license is a legal call rather than a scripting one.