build: add license-checker

[binbin-li]

Description

What this PR does / why we need it:

This pr adds a CI job to check the license header and dependency licenses. It added missing headers to files. And the report shows that there are 2 dependencies are under incompatible license as below screenshot:

The CR one is due to missing LICENSE defined in the v1.0.1, which was added in v2.0.0. However, this is a indirect dependency from github.com/sigstore/cosign/v2, which is not controlled by Ratify.
The go-metrics one is under BSD-2-Clause-Views, which is not compatible with Apache 2.0. All compatible and weak compatible licenses are listed in: https://www.apache.org/legal/resolved.html#weak-copyleft-licenses
The go-metrics is indirect dependency from github.com/sigstore/cosign/v2 as well.

Created issue on cosign: sigstore/cosign#3377

Since those are indirect dependencies, there is no way to fix the broken check. We could have 3 options for it:

1. Remove the dependency check, just keep the license header check.
2. Keep both check but leave this job failing as a warning.
3. Hack these 2 dependencies as passing to make pipeline happy.

As discussed in the PR review meeting, we'll adopt option 3 to exclude those 2 libraries.

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):

Fixes #

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Helm Chart Change (any edit/addition/update that is necessary for changes merged to the main branch)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post Merge Requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (506bcc4) 52.56% compared to head (26a7f0f) 52.56%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1176   +/-   ##
=======================================
  Coverage   52.56%   52.56%           
=======================================
  Files         101      101           
  Lines        6344     6344           
=======================================
  Hits         3335     3335           
  Misses       2688     2688           
  Partials      321      321           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[junczhu]

LGTM