Third-party licenses: a package documents what it contains #180

What you're trying to do

Decide how the repository documents third-party licenses, and write it down once. The question came from a
THIRD-PARTY-NOTICES.TXT in another
project: 102 generated entries, test packages included, each a copyright line, an SPDX id and a link to
licenses.nuget.org, with no license text. That shape suits an application that ships its dependencies. It is
not obviously the answer for a library that only references them.

What is measured

• Nothing third-party is inside a package. dotnet pack CodoMetis.TypeKit.slnx -c Release at 2.4.0 gives
  seven .nupkg; each holds its own assembly (two for the analyzers), its XML documentation and its README.
  analyzers/ carries only CodoMetis.TypeKit.Analyzers.dll and .CodeFixes.dll.
• Dependencies arrive through NuGet. CodoMetis.TypeKit.Generators depends on Metalama.Framework
  (exclude="Build,Analyzers"), and the other packages on Microsoft.CodeAnalysis, EF Core, ASP.NET Core
  OpenAPI and Serilog. Each carries its own license metadata.
• No copied code. A search of src/ for "adapted from", "ported from", "copied from" and copyright lines
  finds none.
• Our own metadata is complete. Each nuspec has <license type="expression">MIT</license> and
  <copyright>; LICENSE is detected by GitHub.
• Nothing checks the dependencies' licenses. A package reference under a copyleft or source-available
  license would flow to consumers of an MIT package unnoticed. That is filed apart: A conventions test holds every shipping dependency's license to an allow-list #181.

What you'd like

One decision record and one CONTRIBUTING section, drafted on docs/third-party-licenses:

1. A package gets a notices file only when it contains third-party code: a bundled or merged assembly, copied
   source, or a binary or container release. Then the file is generated from the shipping projects alone,
   holds the license text, and is packed into the artifact.
2. Otherwise the package documents nothing beyond its own license, its copyright and its dependency list,
   which NuGet already carries.
3. Dependencies' licenses are checked, not listed (A conventions test holds every shipping dependency's license to an allow-list #181).
4. The wording is written so the other public repositories can reuse it. They follow once TypeKit's settles,
   each with its own issue.

Does it change something that compiles or works today?

No. Documentation only.