Build: Correct LICENSE paths for wheels and document the bundled Cython runtime

[shaynhornik]

Closes #3877

Rationale for this change

Follow-up to the 0.12.0 release vote thread findings on the wheel's LICENSE documentation:

1. Vendored paths were wrong in binary distributions. setup.py maps vendor/fb303 and vendor/hive_metastore to top-level fb303 and hive_metastore packages via package_dir, so the LICENSE entries saying the code lives "in vendor/fb303/" were only accurate for the source distribution. Both entries now describe each layout explicitly ("located in vendor/… in the source distribution and shipped as the top-level … package in binary distributions"), so the one LICENSE file that license-files ships into both artifacts is accurate in both.

2. The bundled Cython runtime was undocumented. The compiled pyiceberg.avro.decoder_fast extension embeds the Cython runtime code that Cython generates into every compiled module. Cython is Apache-2.0 licensed with no NOTICE file, so a LICENSE entry (no NOTICE change) documents it, following the format of the existing entries.

Are these changes tested?

Verified by building a wheel from this branch and inspecting it:

• fb303/ and hive_metastore/ are at the wheel root (no vendor/ directory), matching the new wording.
• The updated LICENSE lands at pyiceberg-0.12.0.dist-info/licenses/LICENSE with both fixes present.
• strings on the built decoder_fast .so confirms embedded Cython runtime code.
• dev/check-license (RAT) checks source headers only, so it is unaffected.

Are there any user-facing changes?

No code changes; LICENSE documentation only.

---

AI disclosure: this change was developed with the assistance of Claude Code, per the repository's agent workflow (AGENTS.md). I reviewed the analysis and the wording, and verified the built wheel myself; I take responsibility for the contribution.

[ebyhr]

@jbonofre Could you review this PR?

[kevinjqliu]

We build 2 different kinds of artifacts, the wheels (.whl) and source distribution (tar.gz).
See https://pypi.org/project/pyiceberg/#files

I think both use the same LICENSE file, so we need to sure that the location referenced inside the LICENSE text matches both types of artifacts

[shaynhornik]

Agreed that one LICENSE has to be right for both artifacts, which is why each entry names both layouts rather than replacing one path with the other. I built both from this branch to confirm (python -m build --sdist --wheel):

• sdist (pyiceberg-0.12.0.tar.gz): the Thrift and Hive code is under vendor/fb303/ and vendor/hive_metastore/, matching "located in vendor/… in the source distribution".
• wheel (pyiceberg-0.12.0-cp311-…whl): setup.py's package_dir remaps them, so they land as top-level fb303/ and hive_metastore/ with no vendor/ directory at all, matching "shipped as the top-level … package in binary distributions".
• The identical LICENSE text is at the sdist root and at pyiceberg-0.12.0.dist-info/licenses/LICENSE in the wheel.
• The Cython entry is scoped to "binary distributions" because the sdist excludes the generated decoder_fast.c (MANIFEST.in) and ships only the .pyx; the wheel's compiled .so is where the Cython runtime code appears.

Happy to reword if you'd prefer a different phrasing for the two layouts.