Fix: Use valid SPDX license identifiers and add a NOTICE file

[davetcoleman]

[written by AI]

Problem

Every package.xml in this repo declared a license string that is not a valid SPDX identifier, so no automated tool can resolve what this code is licensed under. Seven packages said Apache2 (SPDX is Apache-2.0) and one said BSD (ambiguous between 2-clause and 3-clause).

Separately, the repo is Apache-2.0 but ships code from four distinct copyright holders with no NOTICE file recording them. Apache-2.0 section 4(d) is written around exactly that file.

Changes

1. Valid SPDX identifiers. Apache2 becomes Apache-2.0 in seven packages, and BSD becomes BSD-3-Clause in abb_irb1200_5_90_moveit_config. No package's actual license changes, only the spelling of the identifier.

2. A NOTICE file recording the four copyright holders whose code ships here, each with the license that applies and which files it covers. Sourced from the source-file headers, not assumed:

Holder	License	Where
ABB Schweiz AG (2020)	BSD-3-Clause	abb_hardware_interface/src/utilities.cpp and related
ROS2-Control Development Team (2020)	Apache-2.0	abb_hardware_interface, modified by PickNik in 2022
Open Source Robotics Foundation (2017)	Apache-2.0
ROS-Industrial (Andrew Short, Levi Armstrong / SwRI)	BSD-3-Clause	abb_irb1200_5_90_moveit_config

Two things deliberately left alone

abb_irb1200_5_90_moveit_config stays BSD-3-Clause, not Apache-2.0. An audit initially flagged it as conflicting with the repo's Apache-2.0 root. On inspection the mismatch is correct: it is an automatically generated ROS-Industrial MoveIt config authored by Andrew Short and maintained by Levi Armstrong at SwRI, and ROS-Industrial ships BSD-3-Clause. Forcing it to match the root would have relicensed someone else's code. The NOTICE now says so explicitly, so the next audit does not re-flag it.

Likewise abb_hardware_interface keeps both Apache-2.0 and BSD-3-Clause tags. That dual declaration is right: abb_hardware_interface.cpp is Apache-2.0 (ros2_control team, modified by PickNik) and utilities.cpp is BSD-3-Clause (ABB Schweiz AG).

The LICENSE file is untouched. Its appendix still carries the standard [yyyy] [name of copyright owner] placeholder, which is how the Apache-2.0 template ships. With four copyright holders, filling that in with a single name would overclaim. The NOTICE is the correct place for that information and is what this PR adds.

Scope

Eight package.xml files (one line each) plus a new NOTICE. No code, no build changes, no behavior change. <license> is manifest metadata that no build step consumes.

Manual verification

None needed for the metadata. Reviewer sanity check worth doing: confirm the NOTICE attributions match what you know of this repo's history, since it is the only file here making factual claims.

Found during a licensing audit of all 109 PickNik-authored public repos. Tracked in PickNikRobotics/moveit_pro#22271.

[davetcoleman]

[written by AI]

Targeting rolling since that is the default branch. The same Apache2 strings are present on humble (and likely iron and foxy), so this wants a backport to whichever branches are still maintained. @nbbrooks, your call on which ones, and I did not assume.