release bundle: sort out licensing situation

[jkowalleck]

a yarn plugin is a bundled one-file solution.
the goal of this project is to provide such a file.

The project itself will provide our code, licensed under Apache-2.0,
which needs to be bundled with 3rd part code.

in case we wanted to ship a bundled plugin, we would need to provide a license file for such an assembly.
This file might look like the following:

<our own LICENSE file>
<our own NOTICE file>

----
        
The <this product> distributions bundle several libraries that are compatibly licensed.  We list these here.

Name: <some-library>
License: <some SPDX id or SPDX expression>
  For details see <path to original license file> 

to get more clarity, I'd consolidate OWASP's legal department. (ongoing; in progress)

[jkowalleck]

maybe some tool can be tailored with the use of yarnpkg/berry#6212 (comment)

maybe https://github.com/CycloneDX/cyclonedx-esbuild-plugin can produce the licenses list ...

PS: metafile is produced, via #84