godep: add details on CNCF whitelist policy

[swinslow]

This PR includes the excellent writeup of the CNCF Whitelist Policy from @nikhita originally in #3231, along with some clarifying comments and edits. (Ref: kubernetes/steering#57 (comment))

(Apologies if there's another way I should have added this to #3231, rather than doing a new PR here!)

/cc @nikhita @dims @justaugustus
members involved in the sig-release licensing subproject

/cc @thockin @cblecker @sttts
dep-approvers

/sig release
/area licensing

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: swinslow
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: jbeda

If they are not already assigned, you can assign the PR to them by writing /assign @jbeda in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• contributors/devel/sig-architecture/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[swinslow]

I note the comment from @justaugustus at #3231 (comment). I'm fine with moving this content to kubernetes/sig-release as he described and just linking to it from here, if that's preferred.

[justaugustus]

@swinslow -- I'm going to close this and have us submit updates to @nikhita's PR instead, just so the conversation is one place.

/close

[k8s-ci-robot]

@justaugustus: Closed this PR.

In response to this:

@swinslow -- I'm going to close this and have us submit updates to @nikhita's PR instead, just so the conversation is one place.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[swinslow]

Sounds good!