Repo needs third-party notices file

[DaveTryon]

Since this repo includes the dist folder (which includes 3rd party code), it needs to include a third-party notices file

[dbjorge]

Component Governance can generate the NOTICE file for us, but note that it relies on the "dependencies" vs "devDependencies" in package.json being an accurate description of which dependencies are distributed vs not. Those lists need to be audited before generating the NOTICE file; in particular, I don't think "webpack" should be a "dependency", not sure if there are other inaccuracies.