fix(license): Attribute vendored AndroidX Compose UI code in Session Replay (#5516)

sentry-android-replay's Nodes.kt vendors code from AndroidX Compose UI
(Apache 2.0, The Android Open Source Project) without attribution:
- boundsInWindow is a faster copy of LayoutCoordinates.boundsInWindow
- fastMinOf/fastMaxOf/fastCoerceIn/fastCoerceAtLeast/fastCoerceAtMost are
  copied from androidx.compose.ui.util.MathHelpers

Add the required source-file attribution header and a THIRD_PARTY_NOTICES.md
entry covering both source files.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>