Refer to CNCF allowlist for 3rd-party licenses approved for inclusion in CNCF repos

[trentm]

This came up in open-telemetry/opentelemetry-js#5305 which is looking to include some ISC-licensed code in opentelemetry-js.git.

Refs: #2504

---

Some notes:

• The original "At this moment, BSD and MIT are the only OSI-approved licenses known to be compatible" language came from Add Copyright Notices section to CONTRIBUTING.md #479
• There is this older issue Add guidelines about allowed licenses for dependencies #649 that may be resolved with this change? /cc @tigrannajaryan
• FWIW, the ASF maintains a list of licenses it "identifies the acceptable licenses for inclusion of third-party Open Source components in Apache Software Foundation products.": https://www.apache.org/legal/resolved.html However, the CNCF lists is probably the better one to treat an authoritative.

[trask]

thanks @trentm!