fix: ship LICENSE, NOTICE and README in the published packages - #1226

Description

The published packages of this monorepo are missing their legal files, and two of the three are missing
their README as well.

Each manifest asks for them:

"files": ["/esm", "/cjs", "/browser", "LICENSE", "README.md"]

but those paths resolve relative to packages/<pkg>/, and LICENSE, NOTICE and (for two of the three
packages) README.md exist only at the repository root, so npm has nothing to match and packs neither.

Evidence from the published artifacts

Listing the current tarballs, everything outside esm/, cjs/ and browser/:

$ curl -sLO https://registry.npmjs.org/@asyncapi/parser/-/parser-3.6.3.tgz
$ tar tzf parser-3.6.3.tgz | grep -vE "^package/(esm|cjs|browser)/"
package/package.json

So no package ships a LICENSE or a NOTICE, and only openapi-schema-parser ships a README.

Why it matters

Apache-2.0 section 4(a) requires a copy of the licence to accompany each distribution of the work, and 4(d)
requires the NOTICE attributions to travel with it. The npm tarball is how essentially every consumer
receives these packages, and it currently carries neither. Separately, @asyncapi/parser and
@asyncapi/multi-parser render with no README on npmjs.com.

Changes

• new scripts/copy-legal.js, copying the root LICENSE and NOTICE into the package being published, plus
  the root README.md only when the package does not ship one of its own (so
  openapi-schema-parser’s README is left alone);
• each package runs it from prepublishOnly, so the files exist by the time npm packs;
• NOTICE added to each files array next to the LICENSE entry that was already there;
• the copied files are gitignored per package.

No new dependency - prepublishOnly already existed in all three manifests, this only prepends one step.

Verifying

npm -w @asyncapi/parser run copy:legal && npm pack -w @asyncapi/parser --dry-run

LICENSE, NOTICE and README.md now appear in the pack listing.