Add Data Licensing Page

[maennchen]

Fixes erlef/security-wg#58

TODO

• Add EEF to the odv.dev DataSource list with the chosen license: https://github.com/google/osv.dev/blob/master/docs/data.md#current-data-sources

[voltone]

Looks good to me: it is bit verbose, but like I said elsewhere, I think it is good to be explicit. If the boundaries are not clear, then consumers of the materials may have to err on the side of caution and assume any data may be copyrighted

[maennchen]

For context, here's a few example of other providers:

Source	License
CVE	Public domain-like
GHSA	CC-BY 4.0
Red Hat	CC-BY 4.0
RustSec	MIT/Apache
Debian	GPL-2.0
Ubuntu	CC-BY-SA

We might consider CC-BY to force attribution or CC-BY-SA to force vulnerability databases to keep the same terms.

I would probably prefer to either CC0 (allow spreading wherever) or CC-BY (force attribution). I would love CC-BY-SA, but I would be scared that we'd be left out of some datasets.

[voltone]

We might consider CC-BY to force attribution or CC-BY-SA to force vulnerability databases to keep the same terms.

I would probably prefer to either CC0 (allow spreading wherever) or CC-BY (force attribution). I would love CC-BY-SA, but I would be scared that we'd be left out of some datasets.

If data is shared in the context of a CVE, with the number visible, then the attribution is implicit: anyone can look up the authoritative record and see where it originated. If someone cuts snippets from our CVEs and uses them in a completely different context then I don't know if we should care. I think the most important goal is to spread this data far and wide, without any impediments. So CC0 seems fine with me

[kikofernandez]

As mentioned before, I believe CC-BY 4.0 solves many of the known issues of CC0 in many jurisdictions. I would rather go by CC-BY 4.0, but I will approve to show that if there is a majority that prefers CC0, then the majority has spoken.