Hand-kept notices

Notices a licence scanner cannot infer: vendored source, bundled data, and the licence texts of components whose packages carry none. All notices.

• Apache-2.0
• Codex-CLI-LICENSE
• Codex-CLI-NOTICE
• GeoNames-CC-BY-4.0
• MaxMind-GeoLite2
• RuleCOSI-MIT
• Treelite-LICENSE