Enable Maven Enforcer checks

[basil]

Problem

pom.xml currently has the enforcer.skip property set to true. This completely disables the Enforcer checks, which hides useful warnings. Unfortunately, re-enabling the Enforcer checks reveals this RequireUpperBoundDeps warning:

[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (display-info) @ jenkins-test-harness ---
[WARNING] Rule 3: org.apache.maven.plugins.enforcer.RequireUpperBoundDeps failed with message:
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for com.google.guava:guava:11.0.1 paths to dependency are:
+-org.jenkins-ci.main:jenkins-test-harness:2.54-SNAPSHOT
  +-org.jenkins-ci.main:jenkins-war:2.60.3
    +-org.jenkins-ci.main:jenkins-core:2.60.3
      +-com.google.guava:guava:11.0.1
and
+-org.jenkins-ci.main:jenkins-test-harness:2.54-SNAPSHOT
  +-org.jenkins-ci.main:jenkins-war:2.60.3
    +-org.jenkins-ci.main:jenkins-core:2.60.3
      +-com.google.inject:guice:4.0
        +-com.google.guava:guava:16.0.1
and
+-org.jenkins-ci.main:jenkins-test-harness:2.54-SNAPSHOT
  +-org.jenkins-ci.main:jenkins-war:2.60.3
    +-org.jenkins-ci.main:jenkins-core:2.60.3
      +-org.kohsuke.stapler:stapler-jrebel:1.250
        +-org.kohsuke.stapler:stapler:1.250
          +-com.google.guava:guava:14.0

Evaluation

Normally, the solution to such conflicts is to add a dependencyManagement section explicitly selecting the highest version of the dependency that is required. Unfortunately, that solution isn't quite feasible for Jenkins's Guava dependency, which has a complicated history due to the way Jenkins does class loading. Bumping Guava in the test harness to 16.0.1 would represent significant risk, since Jenkins core actually delivers Guava 11.0.1 today. The test harness currently delivers a version matching Jenkins core, as can be seen by this output:

$ mvn dependency:tree | grep guava
[INFO] |  |  +- com.google.guava:guava:jar:11.0.1:compile (optional)

To avoid the risk of any possible regressions, we want the version of Guava used in the test harness to match the version of Guava used in Jenkins core in production. However, selecting that version won't satisfy the RequireUpperBoundDeps check.

Solution

The long-term fix is far beyond the realm of a single PR and is tracked in JENKINS-36779. This PR merely adds an exclusion for Guava to the RequireUpperBoundDeps check in the test harness. This allows the remaining Enforcer checks to run, which is a net improvement from the current code (where all Enforcer checks are disabled).

[oleg-nenashev]

It definitely does not make the situation worse, so 🚢 🇮🇹