catalog: attribution_required is true for licences that only require keeping a notice

[TMHSDigital]

material-symbols (Apache-2.0), ms-building-footprints (CDLA) and microsoft-rocketbox (MIT, where the "credit" string is really "keep LICENSE.md") have attribution_required: true. Stack "What this stack owes" panels therefore ask for on-screen credit that the licence doesn't require. (velvetyne is justified by the foundry's own page; gebco and nasa-3d-resources state a reason.)

Fix: set these to false and describe the notice obligation in Notes. Add a check that requires a stated reason (e.g. an Evidence line) when a notice-only or no-attribution licence is marked attribution_required: true.

[TMHSDigital]

Closed by #49: material-symbols, ms-building-footprints and microsoft-rocketbox now have attribution_required false, each with a dated Evidence line quoting its licence (read 2026-09-26). Not done: the check that would require a stated reason whenever a notice-only licence is marked credit-required. Today it would touch velvetyne (sourced), gebco (stated) and nasa-3d-resources, whose credit wording needs re-reading at the source first. Worth adding in the next full review.