[fix][build] Fix the shaded client artifacts: jar contents and Maven publication

[lhotari]

Motivation

The Gradle build (5.0.0-M1-SNAPSHOT, not yet released) produces and publishes the shaded client
artifacts pulsar-client, pulsar-client-admin and pulsar-client-all incorrectly — both in the
Maven metadata it publishes and in the contents of the shaded jars themselves. The problems:

1. Wrong dependency scopes and artifactIds. The gradleup-shadow components["shadow"] maps the
   whole shadow configuration to a single java-runtime variant, so every non-bundled dependency
   was published with runtime scope — losing the api/implementation distinction, so consumers could
   not compile against the non-bundled parts of the public API (e.g. pulsar-client-api). The
   artifacts were also published under their Gradle project names (pulsar-client-shaded, …) instead
   of their historical Maven coordinates (pulsar-client, …). These modules additionally publish
   Gradle Module Metadata (GMM), which Gradle consumers prefer over the POM, so a POM-only fix would
   be ignored by them.

2. The parent POM was never uploaded to the remote. The root project publishes
   org.apache.pulsar:pulsar as a POM-only parent that every child POM references via <parent>.
   Its publishing was hand-rolled in the root build script and declared only the local localDeploy
   repository, never the ASF Nexus repos. As a result the root had no
   publish…ToApacheSnapshotsRepository / …ReleasesRepository task, so a
   publishAllPublicationsToApache… run uploaded every module but silently skipped the parent POM —
   leaving the published modules unresolvable (missing parent).

3. Netty native libraries were not relocated. The shaded jars bundled Netty's native libraries
   (META-INF/native/libnetty_*.so / .jnilib, netty_*.dll) under their original names. Netty's
   shaded NativeLibraryLoader looks them up under the mangled shade-package prefix
   (org_apache_pulsar_shade_), so it could not find them, and the unrelocated names also clash with
   an unshaded Netty on the same classpath. The Windows tcnative native that the Maven build shipped
   was additionally dropped during the Maven → Gradle migration.

4. JSR-305 (javax.annotation) classes leaked into the jar unshaded. The shaded jars bundled the
   com.google.code.findbugs:jsr305 annotation classes in the default javax/annotation/* namespace.
   JSR-305 is a compile-time / static-analysis-only library with no runtime use; shipping it leaks
   javax.* into the global namespace of a shaded artifact (Pulsar 5.0 is moving off javax.*, with
   JSpecify covering nullness).

Modifications

Dependency scopes (POM + GMM)

• pulsar.client-shade-conventions: add a shadowApi dependency bucket and a consumable
  shadowApiElements (java-api) variant carrying the shaded jar, registered on the shadow component
  via addVariantsFromConfiguration(...) { mapToMavenScope("compile") }. Dependencies declared in
  shadowApi publish with compile scope, those in shadow stay runtime — consistently in both
  the POM and the GMM.
• pulsar.public-java-library-conventions: add shadowApi to the published-scope validation list.
• Each non-bundled dependency is split by whether its types are exposed in the public API a consumer
  compiles against (compile: pulsar-client-api, pulsar-client-admin-api, opentelemetry-api)
  or used only internally by the bundled code (runtime: BouncyCastle, the unshaded Jackson
  annotations, the OpenTelemetry incubator, slog/slf4j, jspecify). protobuf-java is intentionally
  not published (it was provided in the Maven build); consumers using Schema.PROTOBUF /
  PROTOBUF_NATIVE supply their own protobuf.

Artifact ids

• pulsar.publish-conventions: read archivesName for the published artifactId in an afterEvaluate
  block (per Gradle's maven-publish deferred-configuration guidance) so a module can override it in
  its build script body.
• pulsar-client-shaded / pulsar-client-admin-shaded: set archivesName to the historical Maven
  artifactId (pulsar-client, pulsar-client-admin). This drives the shaded jar base name, the
  published artifactId and the project's module identity, so the pulsar-bom entries and NAR
  exclusions reference the same names. pulsar-client-all already matches its artifactId.

Parent POM / shared publish repositories

• New convention pulsar.publish-repositories-conventions: owns the publish targets shared by every
  published project — the localDeploy + ASF Nexus repositories, the snapshot/release validation, the
  mavenPublishLock upload-serialization service and GPG signing. It creates no publication and does
  not touch the base/java plugins, so it applies equally to the POM-only root project and to every
  java-library / java-platform module. pulsar.publish-conventions now applies it and keeps only the
  per-module publication wiring; the root build script applies it too (replacing its bare
  maven-publish + signing and its localDeploy-only repositories block). The snapshot/release
  validation now matches on the publish task name instead of task.repository, which is null while the
  root's POM-only publish task is being created.

Shaded jar contents

• pulsar.client-shade-conventions: fix the META-INF/native renaming so Netty's native libraries are
  relocated to liborg_apache_pulsar_shade_netty_* / org_apache_pulsar_shade_netty_* (the previous
  regex never matched the lib-prefixed filenames, and the replacement inserted the prefix before
  lib instead of before netty). pulsar-common: add the
  netty-tcnative-boringssl-static:windows-x86_64 classifier so the Windows native is bundled again
  (the classifier-less base jar carries no natives in netty-tcnative 2.0.x).
• pulsar-client (the pulsar-client-original module): declare jsr305 as compileOnly instead of
  implementation (matching pulsar-broker). It stays on the compile classpath for the
  javax.annotation.* annotations the source uses, but is no longer on the runtime classpath, the
  published POM, or the shaded jar. Consumers that want to run SpotBugs/FindBugs analysis add jsr305
  themselves.
• pulsar.client-shade-conventions: add a verifyShadedJarContents task (wired via shadowJar's
  finalizedBy, so it runs whenever the jar is built) that fails the build if the shaded jar contains
  any file outside the allowed roots META-INF/, org/apache/pulsar/, com/scurrilous/circe/,
  org/apache/avro/reflect/ (intentionally unrelocated so Avro reflection sees user annotations) and
  lib/ (bundled native libs). This turns future un-relocated or leaked content into an immediate
  build failure.

Verifying this change

This is a build-only change and is not exercised by unit tests. Verified locally:

• Generated POMs and Gradle Module Metadata for the three shaded modules show the intended
  compile/runtime split, no protobuf-java, and artifactIds pulsar-client /
  pulsar-client-admin / pulsar-client-all; the pulsar-bom entries pick up the renamed
  coordinates. (The scope/id changes are metadata-only; the jar-content changes below are intentional.)

• Publishing to a file:// "remote" uploads the parent POM (org/apache/pulsar/pulsar/…/pulsar-*.pom)
  alongside the modules; the root publishMavenPublicationToApacheSnapshotsRepository task now exists.

• The three shaded jars contain only the allowed roots: every Netty native is relocated (matching the
  4.2.x release jar, modulo the Netty 4.2 io_uring → io_uring42 rename, and including the Windows
  tcnative .dll), and there are no javax.* classes. pulsar-client-original main and test
  sources still compile.

• verifyShadedJarContents passes for all three jars, and fails listing the offending entries when an
  allowed root is removed. It is configuration-cache and build-cache compatible (CC stores then reuses
  with no problems; it is intentionally not a cacheable task so it always runs against the actual jar).

• Make sure that the change passes the CI checks.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)

The published Maven metadata of pulsar-client, pulsar-client-admin and pulsar-client-all
changes: dependency scopes (api deps → compile, internal deps → runtime), protobuf-java is no
longer a published dependency, and the artifactIds are restored to the historical coordinates. The
contents of the shaded jars also change: Netty native libraries are now relocated (and the Windows
tcnative native is bundled again), and the JSR-305 (javax.annotation) classes are no longer shipped.
These are 5.0.0-M1-SNAPSHOT (unreleased) artifacts, so no released artifact's metadata or contents are
affected.