rewrite README, add MIT license, rename vendored patch doc

- self-contained README (removed references to deleted ARCHITECTURE/GOAL docs)
- add LICENSE (MIT)
- rename third_party/certspotter/CTCLOUD_PATCH.md -> BUCKETEER_PATCH.md and
  update the in-code references

third_party/certspotter/BUCKETEER_PATCH.md

@@ -1,4 +1,4 @@
-# ctcloud patch to upstream CertSpotter
+# Bucketeer patch to upstream CertSpotter
 
 This directory is a copy of upstream CertSpotter
 (https://github.com/SSLMate/certspotter), pulled in as a local module and
@@ -39,7 +39,7 @@ if config.IdentifierSink != nil {
 
 ## Why
 
-The sink gives ctcloud parsed DNS identifiers via a direct in-process Go call:
+The sink gives Bucketeer parsed DNS identifiers via a direct in-process Go call:
 
 ```text
 CT log entry -> CertSpotter parse -> IdentifierSink.HandleIdentifiers -> classifier

third_party/certspotter/monitor/config.go

@@ -17,8 +17,8 @@ import (
 )
 
 // IdentifierSink receives the DNS identifiers parsed from every monitored
-// certificate.  This is a CTCLOUD PATCH to upstream certspotter; see
-// CTCLOUD_PATCH.md.  When non-nil it is invoked on the monitoring hot path
+// certificate.  This is a BUCKETEER PATCH to upstream certspotter; see
+// BUCKETEER_PATCH.md.  When non-nil it is invoked on the monitoring hot path
 // instead of the watchlist/notification machinery.
 type IdentifierSink interface {
 	HandleIdentifiers(ctx context.Context, identifiers *certspotter.Identifiers)
@@ -32,7 +32,7 @@ type Config struct {
 	Verbose             bool
 	HealthCheckInterval time.Duration
 
-	// IdentifierSink is a CTCLOUD PATCH (see CTCLOUD_PATCH.md).  When set,
+	// IdentifierSink is a BUCKETEER PATCH (see BUCKETEER_PATCH.md).  When set,
 	// parsed identifiers are handed directly to it in-process and the normal
 	// watchlist/chain/notification path is skipped.
 	IdentifierSink IdentifierSink

third_party/certspotter/monitor/process.go

@@ -101,8 +101,8 @@ func processCertificate(ctx context.Context, config *Config, entry *LogEntry, ce
 	if err != nil {
 		return processMalformedLogEntry(ctx, config, entry, err)
 	}
-	// CTCLOUD PATCH: hand identifiers directly to the in-process sink and skip
-	// the watchlist/chain/notification path.  See CTCLOUD_PATCH.md.
+	// BUCKETEER PATCH: hand identifiers directly to the in-process sink and skip
+	// the watchlist/chain/notification path.  See BUCKETEER_PATCH.md.
 	if config.IdentifierSink != nil {
 		config.IdentifierSink.HandleIdentifiers(ctx, identifiers)
 		return nil