Add CC-BY-4.0 attribution for Red Hat-sourced advisory content

[rockythorn]

Problem

Rocky Linux errata advisories (e.g. RLSA-2026:23102) re-publish content from the
corresponding Red Hat advisories — synopsis, description, and topic. Red Hat
licenses that advisory content under CC BY 4.0,
which permits reuse but requires crediting the source, linking to the original
advisory and to the license, and indicating that changes were made. None of
Apollo's published outputs currently do this. This was raised by a member of the
Rocky community.

Approach

Attribution text and links are centralized in a new apollo/server/attribution.py
and applied to every surface that carries Red Hat-derived text:

• updateinfo.xml — the <rights> element credits the source advisory under
  CC BY 4.0, plus <reference> entries for the source advisory (type="vendor")
  and the license (type="other").
• v2 and v3 JSON APIs — a structured source object: name, url,
  vendor, license, licenseUrl.
• OSV — a source ADVISORY reference, a Red Hat credit, and
  license/license_url/source_advisory in database_specific.
• RSS feed — the channel copyright carries the CC BY 4.0 notice.
• Server-rendered advisory page — an attribution line linking the source
  advisory and the license.

No database migration is required; the source advisory and its URL are derived
from the existing red_hat_advisory relation. A plain copyright line is kept as
a fallback for any advisory without a Red Hat source.

Testing

• New unit tests across updateinfo, OSV, and v2/v3 serialization; all Bazel
  suites pass.
• Validated against a development database with the server running: v2 and v3
  detail + list, OSV, the live updateinfo.xml (889 updates in one repo file),
  RSS, and the web advisory page all carry the attribution.
• Verified dnf tolerates the new updateinfo reference types, both at the
  source level (libsolv/libdnf/libdnf5) and end-to-end via dnf makecache on
  Rocky 9.

Notes

• Companion change in rocky-linux/errata-frontend (branch
  feature/rhel-advisory-attribution) renders the per-advisory attribution and
  a site-wide footer notice.
• The exact attribution wording is under review; prose may be adjusted.
• No new dependencies.

[rockythorn]

Companion frontend change that renders this attribution: rocky-linux/errata-frontend#4

[jdieter]

Can red_hat_advisory_id be null? If not, then the else statement can never be called. This also means that we can only ever issue advisories that originate from RH, though fixing that's a task for another PR.

[rockythorn]

Good question — I checked the actual schema rather than the ORM model. red_hat_advisory_id is nullable: schema.sql declares it bigint with no NOT NULL, and the live DB reports is_nullable = YES (the FK allows NULL and is ON DELETE CASCADE). The Tortoise model marks the FK non-nullable, but that is not enforced in the database, so the else is not dead code — it keeps a single null row from invalidating the entire updateinfo.xml for a repo, so I have left it in place. The ORM/DB nullability mismatch is probably worth tightening separately, and supporting genuinely non-RH advisories would be its own change, as you note.