We use qt_attribution.json files so far to document third-party code that is part of the Qt sources. Let's also use it for code that is not part of the sources, but that is detected and included from the build directory.

Most of these additional third-party components is provisioned, with the scripts found in qt5/coin. So let's store qt_attribution.json files there. This requires qtattributionsscanner to also look outside of the submodule directory, into ../coin.