ci: check license of third party Go dependencies

[rolinh]

Members of the @cilium/vendor group are currently required to inspect new or updated Go dependencies manually to verify that they comply with the CNCF policy for third party dependencies. This patch adds a tool and associated CI check to do the license verification automatically instead of relying on a manual review. When a non-conformant third party is detected, the CI check fails with a message indicating which dependency is a problem and links to relevant resources. Example:

The third party dependencies below are not allowed under the CNCF's IP policy:
  - github.com/hashicorp/boundary/sdk/wspb (MPL-2.0)

Projects under the following licenses are generally accepted:
  - Apache-2.0
  - BSD-2-Clause
  - BSD-2-Clause-FreeBSD
  - BSD-3-Clause
  - ISC
  - MIT
  - PostgreSQL
  - Python-2.0
  - X11
  - Zlib

Under certain circumstances, exceptions can be made for projects using a different license. For more information, please consult the following resources:
https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
https://github.com/cncf/foundation/tree/main/license-exceptions

See example failed CI run.

[aanm]

/test

[sayboras]

One small comment on the version in go.mod, the rest seems legit, we can improve along the way.

[rolinh]

/test

EDIT: I had to rebase already due to a go.mod conflict.