chore(license): add NVIDIA copyright, SPDX headers and third-party notices

[nv-mtucciarone]

License and headers. Adds the NVIDIA copyright line as the first line of LICENSE (the
Apache 2.0 text itself is unchanged) and the standard SPDX header
(SPDX-FileCopyrightText / SPDX-License-Identifier: Apache-2.0) to every NVIDIA-authored
source file: cmd/refresher/main.go, cmd/webhook/main.go, pkg/credentials/*.go, pkg/loggers/loggers.go, pkg/patching/main.go, pkg/webhook/*.go, Dockerfile, charts/ecr-anywhere/templates/_helpers.tpl.

Third-party notices. Adds THIRD-PARTY.txt listing every third-party Go module statically
linked into the released binary (from go list -deps for linux/amd64 and linux/arm64), with
license, copyright holder, source link and the full text of each license/NOTICE/PATENTS file.
Generated from the module cache; regenerate whenever go.mod changes.

Source tarball in the image. The builder stage now runs go mod vendor after the build and
packs the result; the final stage copies THIRD-PARTY.txt to /THIRD-PARTY.txt and the tarball
to /usr/share/oss-source/third-party-src.tar.gz, the path the notices file names, so anyone who
pulls the image has the notices and the corresponding source (required by MPL-2.0 §3.2 for hashicorp/hcl, pulled in via viper). Adds a few MB to the image.

README and CONTRIBUTING. Adds a one-line
CONTRIBUTING.md ("This project is currently not accepting contributions.") and README sections
for Contributing and License, the latter pointing at LICENSE and THIRD-PARTY.txt.

Verified: go build ./... and go vet ./... pass; a local docker build produces an image with
/THIRD-PARTY.txt and the tarball at the stated path; license-header check passes on all in-scope
files.