compliance: add root third-party notices for Go dependencies

Background

Open-source license compliance requires the source repository itself to carry a complete, redistributable notice for the third-party components it bundles. Apache License 2.0 Section 4(d) requires attribution notices to be passed along with redistribution, and the notice must accurately reflect what is actually shipped. tidb-operator currently has no root notice file for its third-party Go dependencies.

Goals

• Maintain a root ThirdPartyNotices.txt in the repository listing third-party components: names, versions, license identifiers, and license texts, so it can be redistributed with source bundles and release artifacts.
• The content must be traceable to a fixed source commit and fixed generation inputs (pinned tool version, audited overrides).
• Updates should be generated by an automated process (periodic, e.g. weekly) rather than manual editing, without blocking on dependency changes.

Approach

• Collect components and license evidence from the dependency graph (go list -deps ./...), excluding the standard library and first-party modules.
• The generator is only responsible for discovering and extracting evidence; it does not decide legal matters. Cases it cannot decide (missing license metadata, unusual license choices) are handled by audited, exact-version overrides owned by humans. A renderer produces the final stable file; raw generator output is never used directly as the final notice.
• Components with unresolved evidence must be recorded explicitly for review, never silently dropped.

Scope of this track

• PR https://github.com/pingcap/tidb-operator/pull/7049 adds the first root third-party notices for this repository:
  • Scope: Linux/amd64 go list -deps ./... with tests excluded; 215 components.
• Follow-ups: wire the generation into a periodic CI job that opens update PRs, and keep the override/policy inputs versioned in the repository.

Start by reviewing PR 7049 and the repository's dependency graph from go list -deps ./..., with tests excluded. Check how the root ThirdPartyNotices.txt covers the 215 Linux/amd64 components, then assess the follow-ups for periodic CI generation and versioned override or policy inputs. Done means unresolved evidence is explicit and outputs are traceable to fixed inputs.