Prepare repository for Datadog open source review

[thieman]

Working off of https://datadoghq.atlassian.net/wiki/spaces/OS/pages/2178220485/Releasing+Open+Source+Code+at+Datadog

Summary

• Add Datadog open-source compliance docs, templates, NOTICE, SECURITY, and review follow-up notes.
• Add LICENSE-3rdparty.csv generated by dd-rust-license-tool, track Cargo.lock, and add make sync-licenses / make check-licenses.
• Add CI license checks plus a Saluki-style Renovate license-sync workflow and repo-scoped dd-octo-sts policy.
• Add Datadog-required headers to comment-safe files and update repository-specific links to DataDog/rustls-cng-crypto.

Verification

• make check-licenses passed.
• cargo fmt -- --check passed.
• cargo test was attempted locally on macOS but failed before testing this crate in windows-future with missing windows_core::imp::IMarshal / marshaler symbols.
• cargo check --all-targets --target x86_64-pc-windows-msvc was attempted locally on macOS but failed because the host lacks Windows SDK headers required by aws-lc-sys (windows.h).

Full compile/test validation should run in GitHub Actions on windows-latest.

External follow-ups

• Trigger Datadog's self-service hard-coded credential scan.
• Review/enforce branch protection and secure GitHub repository settings before public release.
• Confirm Renovate vs Dependabot for dependency update automation; the auto-sync workflow currently targets Renovate PRs.
• Ensure the dd-octo-sts policy is enabled before relying on automated signed write-back commits.
• Post in #opensource for review and approval before making the repository public.

[datadog-prod-us1-3]

 

🎉 All green!

🛠️ No new code quality issues
🛡️ No new code vulnerabilities

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6c413b4 | Docs | Datadog PR Page | Give us feedback!}

[tobz]

This generally looks right to me, but definitely needs a review from OSPO on the correctness of how we're maintaining the attribution/licensing posture from the original repository.

[thieman]

Yup there's an explicit OSPO review step at the end of all this before it actually gets made public

[jszwedko]

I think we are missing a couple of things:

• A LICENSE file
• deny.toml restricting the license
• CI job that runs cargo deny to check for incompatible licenses

[thieman]

The original LICENSE is still there, though I had a question of whether we're supposed to keep Tom's name in there. My read of MIT is that we should? https://github.com/DataDog/rustls-cng-crypto/blob/main/LICENSE#L1

Will do your next two bullets in the next PR

[jszwedko]

Aaah, doh, missed that the LICENSE was already in the repo.