Refer to CNCF allowlist for 3rd-party licenses approved for inclusion in CNCF repos (#2506)

* Refer to CNCF allowlist for 3rd-party licenses approved for inclusion in CNCF repos

This came up in open-telemetry/opentelemetry-js#5305

Refs: #2504

* mention and refer to the CNCF conditions for including third-party code

Author: trentm

guides/contributor/processes.md

@@ -207,8 +207,9 @@ you will need to [retain the original copyright notice](https://github.com/cncf/
 
 Any contributed third-party code must originally be Apache 2.0-Licensed or must
 carry a permissive software license that is compatible when combining with
-Apache 2.0 License. At this moment, BSD and MIT are the only
-[OSI-approved licenses](https://opensource.org/licenses/alphabetical) known to be compatible.
+Apache 2.0 License. The [CNCF Allowlist License Policy](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#cncf-allowlist-license-policy)
+describes the requirements for including third-party code in CNCF codebases,
+along with a list of approved compatible licenses.
 
 If you make substantial changes to the third-party code, _prepend_ the contributed
 third party file with OpenTelemetry's copyright notice.