Document the offline v3 license download procedure

What does this MR do and why?

An air-gapped instance gets v3 license data by mirroring the whole license bucket with gsutil, which copies both format prefixes and every delta, about 2.4 GB today. This adds a second procedure next to the malware advisory one it mirrors: it asks the distribution service which archives make up the current snapshot and downloads only those, for only the registries the instance has enabled. The script is the malware one with the licenses endpoints swapped in, reading url instead of signed_url because the licenses bucket is public, so the two stay easy to diff.

The rsync step is scoped to v3/ on both sides rather than the whole licenses/ directory, since --delete against the parent would remove an existing v2/ tree that the instance still reads until the cutover. Troubleshooting covers the registry-id naming, the missing checkpoint case, and one licenses-specific check, no license carrying an spdx_expression after a sync means the instance read the v2 layout.

Relates to

• #611230
• #611168