recipes: record upstream provenance for libepoxy, libxcvt, libdisplay-info

These three carried only `path = "source"` with no origin recorded anywhere, so
nothing could distinguish them from Red Bear's own code and the first-party
integrity gate classified them as ours. URLs and versions taken from evidence
in each source tree, not guessed:
  libepoxy         github.com/anholt/libepoxy            meson version 1.5.10
  libxcvt          gitlab.freedesktop.org/xorg/lib/libxcvt   meson version 0.1.3
  libdisplay-info  gitlab.freedesktop.org/emersion/...   meson version 0.4.0

NOT applied to libpciaccess or libudev, which were named alongside these as
upstream. Their source trees are 2 files / 272 lines and 3 files / 1314 lines
respectively -- these are Red Bear's own minimal implementations of those APIs,
not vendored copies of the upstream projects, which are far larger. Recording a
fake upstream for them would downgrade the gate from fatal to a warning on
first-party code, which is the one error direction that loses work that exists
nowhere else. Flagged for confirmation rather than assumed.

local/recipes/libs/libdisplay-info/recipe.toml

@@ -1,4 +1,7 @@
 [source]
+# Vendored local fork of an UPSTREAM project (not first-party Red Bear code).
+# Upstream: https://gitlab.freedesktop.org/emersion/libdisplay-info
+# Snapshot: libdisplay-info 0.4.0 (meson.build version)
 path = "source"
 
 [build]

local/recipes/libs/libepoxy/recipe.toml

@@ -1,4 +1,7 @@
 [source]
+# Vendored local fork of an UPSTREAM project (not first-party Red Bear code).
+# Upstream: https://github.com/anholt/libepoxy
+# Snapshot: libepoxy 1.5.10 (meson.build version)
 path = "source"
 
 [build]

local/recipes/libs/libxcvt/recipe.toml

@@ -1,4 +1,7 @@
 [source]
+# Vendored local fork of an UPSTREAM project (not first-party Red Bear code).
+# Upstream: https://gitlab.freedesktop.org/xorg/lib/libxcvt
+# Snapshot: libxcvt 0.1.3 (meson.build version)
 path = "source"
 
 [build]