HDDS-9692. Do not include SpotBugs at compile scope.

[jojochuang]

What changes were proposed in this pull request?

HDDS-9692. Do not include SpotBugs at compile scope.

Please describe your PR in detail:

• SpotBugs is a LGPL dependency, forbidden per ASF Category X rule https://www.apache.org/legal/resolved.html.
• We could include it in provided or test scope so the dependency doesn't get leaked to users and applications.
• Updated Maven dependency so that mvn license:aggregate-add-third-party can run properly. The solution is inspired by Class not found on mvn license:aggregate-third-party-report mojohaus/license-maven-plugin#73 (comment)

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-9692

How was this patch tested?

Existing unit tests. This patch has no functional change.

[adoroszlai]

Thanks @jojochuang for the patch. The change itself looks good. However, even with this change, spotbugs-annotation shows up in THIRD-PARTY.txt, is that expected?

[jojochuang]

You can manually remove the dependencies of test and provided scope using command

mvn license:aggregate-add-third-party -Dlicense.excludedScopes=test,provided

[adoroszlai]

@SuppressFBWarnings has retention policy CLASS, so it's preserved in the class file, but not during runtime. So is it OK to use it?

We can replace it with XML-based config, which we already use to suppress several warnings. It is more cumbersome and error-prone, but does not require the dependency.

Some of the warnings can even be fixed. ;)

[adoroszlai]

Thanks @jojochuang for the fix.