compliance: add root third-party notices for Go dependencies

## Background

Open-source license compliance requires the source repository itself to carry a complete, redistributable notice for the third-party components it bundles. Apache License 2.0 Section 4(d) requires attribution notices to be passed along with redistribution, and the notice must accurately reflect what is actually shipped. PD currently has no root notice file for its third-party dependencies, so the license information of the Go dependency graph is not published in a self-contained, offline-readable form alongside the source code.

## Goals

- Maintain a root `ThirdPartyNotices.txt` in the repository listing third-party Go components: names, versions, license identifiers, and license texts, so it can be redistributed with source bundles and release artifacts.
- The content must be traceable to a fixed source commit and fixed generation inputs (pinned tool version, audited overrides).
- Updates should be generated by an automated process (periodic, e.g. weekly) rather than manual editing, without blocking on dependency changes.

## Approach

- Collect components and license evidence from the Go module graph (`go list -deps ./...`, tests excluded), excluding the Go standard library and first-party modules.
- The generator is only responsible for discovering and extracting evidence; it does not decide legal matters. Cases it cannot decide (missing license metadata, unusual license choices) are handled by audited, exact-version overrides owned by humans. A renderer produces the final stable file; raw generator output is never used directly as the final notice.
- Components with unresolved evidence must be recorded explicitly for review, never silently dropped.

## Scope of this track

- PR https://github.com/tikv/pd/pull/11179 adds the first root `ThirdPartyNotices.txt` for PD:
- Scope: Linux/amd64 `go list -deps ./...` with tests excluded; 201 components.
- Generated from commit `9eba2bc52362fa433ac19a98e1e3cab467de4332` with a pinned generator (Go 1.25.12, go-licenses v1.6.0).
- Audited exact-version overrides: Apache-2.0 evidence for `github.com/alibabacloud-go/endpoint-util` v1.1.0; FreeType License for `github.com/golang/freetype`.
- Follow-ups: wire the generation into a periodic CI job that opens update PRs, and keep the override/policy inputs versioned in the repository.

Start by reviewing PR #11179 and the root ThirdPartyNotices.txt it adds, then trace the pinned generator and audited override inputs described in this issue. Add a periodic CI process that regenerates the notice and opens update PRs, with policy inputs versioned in the repository; completion means dependency changes do not require manual editing and unresolved evidence remains explicit.

Written by the indexing model from the issue text.