Move SigVisualizer into the monorepo as a GPLv3 component

[neuromechanist]

Closes #10. Third of three component moves (#8 pylsl, #9 LabRecorder both merged).

This one is different: upstream is GPLv3

Unlike pylsl and LabRecorder (both MIT), upstream SigVisualizer is licensed GPLv3. The fork neuromechanist/Secure-SigVisualizer had replaced that with proprietary terms (commits 2dad2be, c07cf36). This PR restores the upstream GPLv3 license and relicenses the README to match, per the component licensing policy of retaining upstream terms.

Because GPLv3 is copyleft, this component stays GPLv3, and the security integration added to it is GPLv3 too. That is correct and required, not a choice.

The added code contains no cryptography (verified)

The security implementation lives entirely in liblsl-secure. The additions here only read status through the public LSL API:

• lsl_security_helper.py is a pylsl compatibility shim that ctypes-declares lsl_get_security_enabled / lsl_get_security_fingerprint and attaches wrapper methods
• paintwidget.py / sigvisualizer.py display a lock indicator and detect mismatches

No libsodium calls, no key handling, no encryption. Same as the other two components; the difference here is purely the upstream license.

Licensing structure

• Root LICENSE COMPONENT LICENSING POLICY generalized to name the GNU GPL and state that a copyleft component is aggregated under GPLv3 section 5, not brought under the proprietary terms
• THIRD-PARTY-NOTICES.md references apps/SigVisualizer/LICENSE rather than inlining 674 lines
• COMPONENT.md records provenance and the GPLv3 status

For OIC review (flagged, not blocking)

SigVisualizer (GPLv3) imports the in-repo pylsl and, at the user's runtime, loads liblsl-secure (proprietary) via ctypes. Whether distributing a GPLv3 application whose intended runtime dependency is a proprietary library creates any obligation is a question for counsel. It is the same question that already applies to the drop-in library-replacement route, and co-location in one repository is mere aggregation under GPLv3 section 5. Merging this is reversible if OIC prefers a different arrangement.

Docs

docs/integration/sigvisualizer.md previously told users to clone from labstreaminglayer/App-SigVisualizer; it now builds the in-repo component against apps/pylsl.