Create skill to check for license attribution

[markushi]

Let's create a skill which ensures that any new code attribution which contains snippets of vendored code is properly attributed.

Ideally we have the following components

1. A new check-code-attribution skill

A Skill which checks the PR diff agains the main branch for vendored / copied code, and if the attribution is missing, adds proper attribution.

2. Integration to create-java-pr skill

The existing skill should check the attribution as well, allowing us to catch attribution issues quite early.

3. Integration into CI

For any new PR targeting main, we should run the skill. See JS for some inspiration, on how skill invocation works:

https://github.com/getsentry/sentry-javascript/actions/runs/25426078130/workflow#L55-L77

TBD: should the CI check fail in case of error, how's the UX for resolving attribution issues

[linear-code]

JAVA-499

[markushi]

Example of how we show attribution:

sentry-java/sentry/src/main/java/io/sentry/vendor/gson/stream/JsonScope.java

Lines 1 to 20 in 88e5035

	/*
	* Copyright (C) 2010 Google Inc.
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	// Source: https://github.com/google/gson
	// Tag: gson-parent-2.8.7
	// Commit Hash: 4520489c29e770c64b11ca35e0a0fdf17a1874ab
	// Changes: @ApiStatus.Internal

https://github.com/getsentry/sentry-java/blob/main/THIRD_PARTY_NOTICES.md