Note that changes to licensing are controversial (#4975)

# Objective

- In #4966, @DJMcNab noted that the changes should likely have been flagged as controversial, and blocked on a final pass from @cart.
  - I think this is generally reasonable.
  - Added as an explicit guideline.
- Changes to top-level files are also typically controversial, due to the high visible impact (see #4700 for a case of that).
  - Added as an explicit guideline.
- The licensing information of our included assets is hard to find.
   - Call out the existence of CREDITS.md

CONTRIBUTING.md

@@ -119,6 +119,8 @@ PRs are controversial if there is serious design discussion required, or a large
 7. Large-scale code reorganization.
 8. High levels of technical complexity.
 9. Adding a dependency.
+10. Touching licensing information (due to the level of precision required).
+11. Adding root-level files (due to the high level of visibility).
 
 Finally, changes are "relatively uncontroversial" if they are neither trivial or controversial.
 Most PRs should fall into this category.

README.md

@@ -109,13 +109,31 @@ Additionally, we would like to thank the [Amethyst](https://github.com/amethyst/
 
 ## License
 
-Bevy is free and open source! All code in this repository is dual-licensed under either:
+Bevy is free, open source and permissively licensed!
+Except where noted (below and/or in individual files), all code in this repository is dual-licensed under either:
 
 * MIT License ([LICENSE-MIT](LICENSE-MIT) or [http://opensource.org/licenses/MIT](http://opensource.org/licenses/MIT))
 * Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or [http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0))
 
-at your option. This means you can select the license you prefer! This dual-licensing approach is the de-facto standard in the Rust ecosystem and there are [very good reasons](https://github.com/bevyengine/bevy/issues/2373) to include both.
+at your option.
+This means you can select the license you prefer!
+This dual-licensing approach is the de-facto standard in the Rust ecosystem and there are [very good reasons](https://github.com/bevyengine/bevy/issues/2373) to include both.
 
-Unless you explicitly state otherwise, any contribution intentionally submitted
-for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any
-additional terms or conditions.
+Some of the engine's code carries additional copyright notices and license terms due to their external origins.
+These are generally BSD-like, but exact details vary by crate:
+If the README of a crate contains a 'License' header (or similar), the additional copyright notices and license terms applicable to that crate will be listed.
+The above licensing requirement still applies to contributions to those crates, and sections of those crates will carry those license terms.
+The [license](https://doc.rust-lang.org/cargo/reference/manifest.html#the-license-and-license-file-fields) field of each crate will also reflect this.
+For example, [`bevy_mikktspace`](./crates/bevy_mikktspace/README.md#license-agreement) has code under the Zlib license (as well as a copyright notice when choosing the MIT license).
+
+The [assets](assets) included in this repository (for our [examples](./examples/README.md)) typically fall under different open licenses.
+These will not be included in your game (unless copied in by you), and they are not distributed in the published bevy crates.
+See [CREDITS.md](CREDITS.md) for the details of the licenses of those files.
+
+### Your contributions
+
+Unless you explicitly state otherwise,
+any contribution intentionally submitted for inclusion in the work by you,
+as defined in the Apache-2.0 license,
+shall be dual licensed as above,
+without any additional terms or conditions.