reluctantly added the source itself for people who don't have a working CVS

this also prevents possible future issues with versions out of sync that
add new files this doesn't account for, or stuff like that.

I think everybody should be fetching the source from the CVS servers
themselves, and obviously verifying the SSH fingerprint while they're at it.

The entire point of making this a separate build system instead of a standalone
version was so that if people already trust the OpenBSD sources, they'd only
have a small bit of code (my additions) to audit, instead of diffing my copy of
it vs. the upstream version, and figuring out what exact revisions I have
locally, etc. which most people probably wouldn't do anyway.
added license
added README