fix(licenses): disclose dependencies missing from THIRD_PARTY_NOTICES.md

Thirty-one Go modules linked into the released binaries were absent from
the notices file. They are redistributed, so their licenses have to appear
there. Module count goes 207 -> 238.

Two independent causes.

The stdlib ignore list was built with `go list std | cut -d/ -f1`, keeping
only the first path segment. That yields the bare segment `go` (from
go/ast, go/build, ...), and `go-licenses --ignore` matches by PREFIX — so
`go` also matched every third-party module under go.opentelemetry.io and
go.yaml.in, dropping them silently with no error anywhere. Passing full
stdlib package paths cannot collide that way.

Separately, go-licenses cannot classify three modules: in-toto/attestation
is a nested module (path ends /go/v1) whose LICENSE lives at the repository
root and is therefore absent from its module zip, and in-toto-golang and
json-canonicalization ship a LICENSE its classifier does not recognise. All
three are Apache-2.0, verified by reading the files. Committed copies under
licenses/overrides/ resolve them, keeping generation hermetic.

Recovered: opentelemetry 3 -> 21 mentions, go.yaml.in 0 -> 6, in-toto
0 -> 7, json-canonicalization 0 -> 3.

Adds a completeness gate so this cannot recur silently: every third-party
package reachable from ./cmd/... must be covered by an index entry, or the
build fails naming the packages. Nothing verified that before — the whole
pipeline trusted go-licenses to report what it was asked about, and it did
not.

The gate skips index keys with no slash. go-licenses emits a bare
"github.com" row when it cannot resolve a package to a module, and kept as
a prefix that single row matches every package under that host, which made
the first version of this check vacuous.

Verified both directions: the full configuration passes and lists all four
module groups, and removing the overrides fails the build naming the exact
packages left undisclosed.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny