Require a recorded source for every bundled image and media file #8985

Task Summary

Part of #8800. Two gaps let these files in unnoticed:

• The license header check (check-header.yml) skips binary files, so an image or video can be added without anyone recording where it came from.
• Nothing checks that files .licenserc.yaml excludes with the comment "see LICENSE file for attribution" are actually listed in LICENSE. That is how jupyter-logo.svg slipped through on release/v1.3.

Proposed fix:

1. Add a provenance manifest at the repository root, with one entry per image or media file: its path, its origin (project-made, third-party or unknown), and for third-party files the source and licence. The manifest ships in the source release, so release voters can check it.
2. Add a step to check-header.yml that fails when:
   • an image or media file in the repository has no manifest entry;
   • a third-party entry is missing from LICENSE, or from frontend/LICENSE-binary for files under frontend/;
   • a path that .licenserc.yaml excludes as "see LICENSE file for attribution" is missing from LICENSE.
3. Add a test_*.sh for the check under .github/scripts/, so the existing infra job runs it.

This does not have to wait for the audit in #8984. Files whose source is not known yet are entered as unknown. New files are covered right away, the unknown entries become the audit's to-do list, and a DISCLAIMER-WIP, if one is needed, can point to them.

Task Type

• Refactor / Cleanup
• DevOps / Deployment / CI
• Testing / QA
• Documentation
• Performance
• Other