Add @rules_license style license declarations

[aiuto]

Add a first round of rules_license declarations to rules_pkg.

• This depends on First cut at making a release binary rules_license#26 and the 0.0.1 release of rules_license.
• Some buildifier reformatting made some non-behavioral format changes.
• Next steps
  • to use rules_pkg to distribute a runtime only version of rules_license
  • update rules_pkg to point to rules_license 0.0.2
  • vendor rules_license into bazel
  • update bazel to use this new rules_license

RELNOTES: New dependency on @rules_license.

[aiuto]

cc: @danielmachlab

[nacl]

The idea seems sound, but the question I'm wondering about is how this would be propagated to the other bazelbuild projects.

I don't deeply mind being the first one to consume rules_license, but I'm wary because the API might change and have ripple effects on downstream consumers.

See suggestions below.

[danielmachlab]

Hi Tony, besides Andrew's comments, the changes you made look good to me. Just left one question

[nacl]

LGTM, given the discussion.

The new dependency on rules_license should be documented in the release notes. We might need a tag for that.

[aiuto]

About being the first adopter: Yes. Since I am doing development on both rules, it is easier to quickly rev and iron out things before other teams start.

About possible changes: The API for license users is intended to be strictly backwards compatible forever. For the most part, there should only be one license target in any rule set. In general, they will always take the form we have used in this PR

license(
    name = "license",
    license_kinds = [
        "@rules_license//licenses/spdx:Apache-2.0"
    ],
    license_text = "LICENSE",
)

This declares that I am using an Apache-2.0 license and the text of it is in the file LICENSE. There may be backwards compatible additions over time.

The API for consuming these declarations to build audit trails and SBOMs will definitely change a lot in the next few months, but that will only impact organizations who want to establish their own audit policies.