Add pip-licenses target (make licenses) to regenerate NOTICE / THIRD_PARTY attribution

## Summary
Add a [`pip-licenses`](https://github.com/raimon49/pip-licenses) Makefile target so that
the `NOTICE` file and a `THIRD_PARTY` attribution document can be regenerated from the
currently installed package set with a single command.

## Motivation
- ASF policy requires the `NOTICE` file to credit all bundled third-party components
- Manually maintaining attribution is error-prone when dependencies change
- `pip-licenses` outputs Markdown, CSV, JSON, or plain text — suitable for both human
review and automated checks
- Apache Airflow and Superset both use tooling to keep attribution current

## Proposed changes
1. Add `pip-licenses` to dev dependencies
2. Add `make licenses` target that runs:
```
pip-licenses --with-authors --with-urls --format=markdown > THIRD_PARTY.md
```
3. Add `THIRD_PARTY.md` to the repository (or generate at release time)
4. Document the process in the release checklist / `DEVELOPER_GUIDE.md`

## References
- https://github.com/raimon49/pip-licenses
- ASF NOTICE file policy: https://www.apache.org/legal/src-headers.html