Add CC-BY-4.0 attribution for Red Hat-sourced advisory content

[rockythorn]

Problem

Rocky Linux errata advisories (e.g. RLSA-2026:23102) re-publish content from the
corresponding Red Hat advisories — synopsis, description, and topic. Red Hat
licenses that advisory content under CC BY 4.0,
which permits reuse but requires crediting the source, linking to the original
advisory and to the license, and indicating that changes were made. None of
Apollo's published outputs currently do this. This was raised by a member of the
Rocky community.

Approach

Attribution text and links are centralized in a new apollo/server/attribution.py
and applied to every surface that carries Red Hat-derived text:

• updateinfo.xml — the <rights> element credits the source advisory under
  CC BY 4.0, plus <reference> entries for the source advisory (type="vendor")
  and the license (type="other").
• v2 and v3 JSON APIs — a structured source object: name, url,
  vendor, license, licenseUrl.
• OSV — a source ADVISORY reference, a Red Hat credit, and
  license/license_url/source_advisory in database_specific.
• RSS feed — the channel copyright carries the CC BY 4.0 notice.
• Server-rendered advisory page — an attribution line linking the source
  advisory and the license.

No database migration is required; the source advisory and its URL are derived
from the existing red_hat_advisory relation. A plain copyright line is kept as
a fallback for any advisory without a Red Hat source.

Testing

• New unit tests across updateinfo, OSV, and v2/v3 serialization; all Bazel
  suites pass.
• Validated against a development database with the server running: v2 and v3
  detail + list, OSV, the live updateinfo.xml (889 updates in one repo file),
  RSS, and the web advisory page all carry the attribution.
• Verified dnf tolerates the new updateinfo reference types, both at the
  source level (libsolv/libdnf/libdnf5) and end-to-end via dnf makecache on
  Rocky 9.

Notes

• Companion change in rocky-linux/errata-frontend (branch
  feature/rhel-advisory-attribution) renders the per-advisory attribution and
  a site-wide footer notice.
• The exact attribution wording is under review; prose may be adjusted.
• No new dependencies.

[rockythorn]

Companion frontend change that renders this attribution: rocky-linux/errata-frontend#4

[rockythorn]

Revised in response to the review comments here, plus a separate pass on the attribution wording. Everything is folded into the existing single commit (force-pushed).

Addressing the review

• Tests — added apollo/tests/test_api_advisories.py covering the v3 source derivation (both the Red Hat-sourced path and the no-source path). attribution.source_fields and the serializer models are also covered in apollo/tests/test_api_compat.py.
• red_hat_advisory_id nullability — I checked the actual schema rather than the ORM: the column is nullable (schema.sql declares it bigint with no NOT NULL, and the live DB reports is_nullable = YES; the FK permits NULL). The Tortoise model marks the FK non-nullable, but that isn't enforced in the database, so the fallback isn't dead — it keeps a single null row from invalidating an entire updateinfo.xml. I left that thread open in case you'd rather tighten the schema (add NOT NULL) instead, which would let us drop the fallback.
• Hardcoded values in advisory.jinja — attribution.py is now registered as a Jinja global (apollo/server/utils.py), and the template references {{ attribution.red_hat_errata_url(...) }} / {{ attribution.SOURCE_VENDOR }} / {{ attribution.SOURCE_LICENSE_URL }} / {{ attribution.LICENSE_NAME }} instead of hardcoded strings, so there is a single source of truth.

Wording pass (separate review of the attribution text)

• The copyright notice uses the © symbol instead of (C).
• Standardized the change indication on "…, with modifications." (previously "…; modified by ").
• Both are centralized in apollo/server/attribution.py.

All 14 Bazel test suites pass, and the change was validated end-to-end against a development database — the v2 and v3 advisory APIs, OSV, the live updateinfo.xml, RSS, and the rendered advisory page all carry the attribution.