Document contributions from external projects which are part of the repository

[stweil]

The repository slub/dfg-viewer includes code and other contributions from external projects, but does not give credits for those projects in its README. There are also no files which document such external dependencies in a way which allows Dependabot or other tools to warn if there are known security issues in the code from those external projects and required security updates.

Known examples (maybe more exist):

• jquery 3.6.0 (2021)
• highlight 10.7.2 (2021)
• Google fonts (2020)

[beatrycze-volk]

Thanks for mentioning it. Could you link an example here of how such referencing should be made?