add manifests for 3rdparty directory contents

It's really a good idea to have some clue what the heck you're bundling.
These files use a format I just made up to note various important
attributes of each bundled component, including its upstream source,
closest matching upstream version, whether it's PSR-0 compliant, license,
and notes about downstream changes.