rewrite README, add MIT license, rename vendored patch doc

- self-contained README (removed references to deleted ARCHITECTURE/GOAL docs)
- add LICENSE (MIT)
- rename third_party/certspotter/CTCLOUD_PATCH.md -> BUCKETEER_PATCH.md and
  update the in-code references

third_party/certspotter/monitor/config.go

@@ -17,8 +17,8 @@ import (
 )
 
 // IdentifierSink receives the DNS identifiers parsed from every monitored
-// certificate.  This is a CTCLOUD PATCH to upstream certspotter; see
-// CTCLOUD_PATCH.md.  When non-nil it is invoked on the monitoring hot path
+// certificate.  This is a BUCKETEER PATCH to upstream certspotter; see
+// BUCKETEER_PATCH.md.  When non-nil it is invoked on the monitoring hot path
 // instead of the watchlist/notification machinery.
 type IdentifierSink interface {
 	HandleIdentifiers(ctx context.Context, identifiers *certspotter.Identifiers)
@@ -32,7 +32,7 @@ type Config struct {
 	Verbose             bool
 	HealthCheckInterval time.Duration
 
-	// IdentifierSink is a CTCLOUD PATCH (see CTCLOUD_PATCH.md).  When set,
+	// IdentifierSink is a BUCKETEER PATCH (see BUCKETEER_PATCH.md).  When set,
 	// parsed identifiers are handed directly to it in-process and the normal
 	// watchlist/chain/notification path is skipped.
 	IdentifierSink IdentifierSink