[Feature]: Generate a third-party attribution / NOTICE file with full license texts

### Background and motivation

Most permissive licenses (MIT, BSD, Apache-2.0) require you to reproduce the license text and copyright notice when you redistribute software that uses them. For anyone shipping a desktop application, a container image, or an on-premises product, producing that attribution file is a legal obligation, not a nice-to-have.

In practice this is one of the most common reasons organisations end up paying for a commercial license-compliance tool. PackageGuard already knows every package, its version and its SPDX license, and already fetches license information from GitHub — it is most of the way there.

**Proposal**

```bash
packageguard . --attribution-file THIRD-PARTY-NOTICES.md
packageguard . --attribution-file notices.html --attribution-format html
```

Design points:

- **Full license text, not just the identifier.** "MIT" is not attribution; the actual text with the actual copyright holder is. Texts come from the package itself (`licenses/` folder, embedded license file), the repository, or the SPDX license list as a fallback.
- **Copyright holders.** Extracting the `Copyright (c) YYYY Name` line is what makes the output legally meaningful, and it is also the part most likely to need a manual override when a package does not state it clearly.
- **Deduplication.** Many packages share identical MIT text differing only in the copyright line. Grouping by license and listing the packages under each keeps the file readable rather than producing a 40,000-line wall.
- **Caching.** License texts are large and stable. They belong in the existing cache, though probably in a separate file rather than bloating `cache.bin`.
- **Manual overrides.** Some packages state their license badly or not at all. A config section mapping package to a hand-written attribution block is necessary for this to be usable in the real world.
- **Scope control.** Test-only and build-only dependencies are usually not redistributed and should be excludable, otherwise the file misrepresents what actually ships.
- **Verification mode.** A `--verify-attribution` flag that fails when the committed notices file is out of date turns this into something CI can enforce, rather than something someone regenerates and forgets.

Formats worth supporting: Markdown (readable in the repo), plain text (`THIRD-PARTY-NOTICES.txt`, the conventional shipping form) and HTML (for an in-app "Licenses" screen).

### Alternative Concerns

- Dedicated tools such as `dotnet-project-licenses` exist, but they only cover NuGet, whereas PackageGuard already spans NuGet and the npm family in one pass.
- Teams could generate this from the SBOM, but SBOM formats reference licenses by identifier and generally do not carry full texts.

### Are you willing help with a pull-request?

No

The issue names no files or tests. Start by tracing the CLI option handling, package and license information flow, GitHub fetching, and existing cache described in the proposal. Done would require an agreed design covering attribution sources, copyright holders, deduplication, caching, overrides, dependency scope, verification, and Markdown, text, and HTML output.

Written by the indexing model from the issue text.