fix: restore proper license headers for third-party code

[bobbai00]

What changes were proposed in this PR?

The third-party code (all MIT licensed, Category A) is compatible with Apache License 2.0 but requires proper attribution per Apache policy. This PR addresses license compliance issues identified during an audit:

1. Restored original MIT license headers for third-party code:

   • common/workflow-operator/src/main/scala/com/kjetland/** (mbknor-jackson-jsonschema)
   • frontend/src/app/common/formly/array.type.ts (Google Angular)

2. Updated LICENSE file with proper third-party attribution section including full MIT license text for each bundled dependency

3. Updated .licenserc.yaml to exclude third-party files from Apache license header checking

4. Added sbt-license-report plugin for automated dependency license tracking and compliance auditing

Any related issues, documentation, discussions?

Closes #4135. Related to #4132.

How was this PR tested?

Was this PR authored or co-authored using generative AI tooling?

Co-authored with Claude code.

[parshimers]

While this fixes some of the issues, I still think there are more remaining.
Anything under frontend/src/app/common/formly is MIT-licensed by Google, not just that one file.
Furthermore the required attribution from the MIT license belongs in NOTICE, not LICENSE. The text of the Apache License actually refers to the NOTICE file (https://www.apache.org/licenses/LICENSE-2.0.html#redistribution) as the place where these sorts of attributions go.

I would also suggest that this task not be done via Claude or other LLMs. I don't think it's the right tool for the job. Using a script that an LLM might generate could be good, but there is no easy way to check the validity of the output an LLM would generate in this task. In fact it's exceedingly hard to validate this task, and easy to mistake it for being done correctly, as we have seen. Therefore the method in which it is done is important to scrutinize and have a high degree of confidence in.

My method so far has been to look at the diff of the change that added all of the ASF headers (and inadvertently changed some), and look carefully at any instance where lines were removed instead of added. There are not many of these. Each of those should be scrutinized and marked as either appropriate or mistaken.

[bobbai00]

While this fixes some of the issues, I still think there are more remaining. Anything under frontend/src/app/common/formly is MIT-licensed by Google, not just that one file. Furthermore the required attribution from the MIT license belongs in NOTICE, not LICENSE. The text of the Apache License actually refers to the NOTICE file (https://www.apache.org/licenses/LICENSE-2.0.html#redistribution) as the place where these sorts of attributions go.

I would also suggest that this task not be done via Claude or other LLMs. I don't think it's the right tool for the job. Using a script that an LLM might generate could be good, but there is no easy way to check the validity of the output an LLM would generate in this task. In fact it's exceedingly hard to validate this task, and easy to mistake it for being done correctly, as we have seen. Therefore the method in which it is done is important to scrutinize and have a high degree of confidence in.

My method so far has been to look at the diff of the change that added all of the ASF headers (and inadvertently changed some), and look carefully at any instance where lines were removed instead of added. There are not many of these. Each of those should be scrutinized and marked as either appropriate or mistaken.

Thank you for your review! I will manually check files and make the fix complete.

I have one question regarding the location of attribution. Quoting from https://infra.apache.org/licensing-howto.html#permissive-deps,

In LICENSE, add a pointer to the dependency's license within the distribution and a short note summarizing its licensing:
This product bundles SuperWidget 1.2.3, which is available under a
"3-clause BSD" license. For details, see deps/superwidget/.
Under normal circumstances, there is no need to modify NOTICE to mention a bundled dependency.

Seems the attribution should still be put in LICENSE, not NOTICE?