Add third-party notices for shipped dependencies

[Chris-Wolfgang]

Summary

This package ships third-party runtime dependencies but has no license-audit gate or third-party notices documentation.

Reference implementation

See Chris-Wolfgang/IAsyncEnumerable-Extensions#306 for the pattern already adopted (merged to vNext 2026-08-26):

• .github/workflows/license-audit.yaml — runs dotnet-project-licenses against src/'s shipped dependency graph on every PR touching a .csproj, plus weekly
• licenses/allowed-licenses.json — MIT/Apache-2.0/BSD-2/BSD-3/ISC/0BSD allowlist
• THIRD-PARTY-NOTICES.md — hand-maintained table of shipped runtime deps, packed into the NuGet output alongside README.md

Current shipped runtime dependencies (from fleet audit, 2026-08-26)

• Microsoft.Extensions.Logging.Abstractions 10.0.10 (both projects)
• EntityFramework (classic EF6) 6.5.2 (EF6 project)

Acceptance criteria

• .github/workflows/license-audit.yaml added, gating src/ (not tests/benchmarks) against the allowlist
• licenses/allowed-licenses.json added
• THIRD-PARTY-NOTICES.md added at repo root, listing all shipped runtime deps with version + license
• csproj(s) pack THIRD-PARTY-NOTICES.md into the NuGet output (Pack="true" PackagePath="")
• CHANGELOG.md updated

Part of a fleet-wide third-party notices audit (2026-08-26).