Pre-publish privacy audit: scrub the simulator serial, harden the sdist, add licences

Audited the package against the two-stage procedure before a first PyPI
publish. The sdist and wheel were already tight, but three things needed
fixing and the controls needed to become real rather than documented.

The simulator volunteered high="PI04" as its product serial, which is the
real Bebop 2 serial prefix. Nothing unique to one aircraft, but a realistic
prefix invites being quoted into a bug report as a specimen, so it now reads
"N0TAREAL" / "0000000SIM" with a comment saying why it is nonsense on
purpose. The low half and the 500.0 no-fix GPS sentinel were already fake.

Hardened [tool.uv.build-backend] source-exclude well past the directories
that exist today: captures at any depth, log dumps, recorded media by
extension, caches, and anything credential-shaped. .gitignore governs git
and source-exclude governs the sdist; a capture can sit in one and not the
other, which is how this kind of data reaches an immutable index. Verified
the broad patterns do not over-reach: arsdk-xml/ with PROVENANCE.md and
tools/logs.py both still ship.

Added LICENSE (MIT) and LICENSE-arsdk-xml (Parrot SA's BSD-3-Clause), and
corrected the declared licence to "MIT AND BSD-3-Clause". The vendored XML
ships in both artifacts because nothing here decodes a command without it,
so MIT alone understated what is in the box. Both texts now appear in the
artifacts and in the metadata.

test_packaging.py grows privacy guards that fail on a serial prefix, a P7
CPU id, any MAC, a high-precision coordinate, an absolute home path, or any
private address other than the drone's own documented 192.168.42.0/24. Each
pattern was checked against the real identifiers to confirm it bites, since
a guard that passes on an empty tree proves nothing.

Example address in test_arsdk_session.py moved to RFC 5737 space.

504 tests pass, ruff clean.

tests/test_arsdk_session.py

@@ -404,10 +404,12 @@ def test_probe_gives_up_on_a_closed_port_quickly():
 def test_an_explicit_address_is_trusted_without_probing():
     # A caller who names an address wants the connection error, not a
     # discovery verdict, so find() must not quietly return None here.
-    found = discovery.find("10.1.2.3")
+    # 192.0.2.0/24 is RFC 5737 documentation space, so this cannot name a host
+    # on whatever network the suite happens to run on.
+    found = discovery.find("192.0.2.7")
     assert found is not None
-    assert (found.ip, found.via) == ("10.1.2.3", "given")
-    assert found.address == ("10.1.2.3", 44444)
+    assert (found.ip, found.via) == ("192.0.2.7", "given")
+    assert found.address == ("192.0.2.7", 44444)
 
 
 # -- an event we cannot name ---------------------------------------------