third_party packages have no metadata describing how we got here

The packages in third_party do not have any descriptive information defining their provenance. We do not know

- when we imported them
- from what canonical upstream source
- if we modified them
- if we *did* modify them, is this a local change or a cherrypick of an upstream commit.
- if local modifications changed the license in any way

Without this, it is impossible to evaluate any PR against them.
Inspired by https://github.com/bazelbuild/bazel/pull/12292

cc/ @sventiffe

Start by inspecting the packages under third_party and the related Bazel pull request 12292 for the intended provenance approach. Define metadata covering import date, canonical upstream source, modifications, upstream cherry-picks versus local changes, and license impact; done means each relevant package has this information documented well enough to evaluate future PRs.

Written by the indexing model from the issue text.