Clarify hash and digest licensing obligations

[helly25]

Clarify that the default hash and digest libraries do not remove mbo's own Apache-2.0 requirements. They introduce no additional third-party requirements; only the optional extra-hash target adds MIT and BSD notice obligations.

AG;DR

• Replace the misleading claim that the default targets carry no compliance obligation.
• State that mbo users must comply with mbo's Apache-2.0 license, including applicable notice and redistribution requirements.
• Distinguish those requirements from the additional MIT and BSD-2-Clause notices attached to //mbo/hash:hash_extra_cc.
• Keep the rule-level guidance explicit for direct and transitive inclusion.

Validation:

• pre-commit run --files README.md

Synchronized with main after release-site PR #433 merged because GitHub rejected the prior required-check context. The licensing clarification and release-site documentation are both preserved; CI is validating the new pushed head.