Add pip-licenses target (make licenses) to regenerate NOTICE / THIRD_PARTY attribution

[janhoy]

Summary

Add a pip-licenses Makefile target so that
the NOTICE file and a THIRD_PARTY attribution document can be regenerated from the
currently installed package set with a single command.

Motivation

• ASF policy requires the NOTICE file to credit all bundled third-party components
• Manually maintaining attribution is error-prone when dependencies change
• pip-licenses outputs Markdown, CSV, JSON, or plain text — suitable for both human
  review and automated checks
• Apache Airflow and Superset both use tooling to keep attribution current

Proposed changes

1. Add pip-licenses to dev dependencies
2. Add make licenses target that runs:

   pip-licenses --with-authors --with-urls --format=markdown > THIRD_PARTY.md
   

3. Add THIRD_PARTY.md to the repository (or generate at release time)
4. Document the process in the release checklist / DEVELOPER_GUIDE.md

References

• https://github.com/raimon49/pip-licenses
• ASF NOTICE file policy: https://www.apache.org/legal/src-headers.html