Fix NOTICE and LICENSE in the gcp-bundle jar

[jbonofre]

This change includes:

• Update versions in LICENSE and NOTICE
• Remove opencensus-proto from LICENSE as not found in the runtime classpath and the jar
• Add io.opentelemetry:* in LICENSE as the classes are in the jar
• cleanup on ASF projects references
• Reformat Netty NOTICE
• Add gRPC NOTICE content
• Add perfmark NOTICE content
• Add conscrypt NOTICE content

[jbonofre]

@amogh-jahagirdar @rdblue @Fokko This is the update/fix for gcp-bundle extracted from #12095

[rdblue]

We need to suppress this and include the stephenc findbugs implementation instead. This one has licensing issues and the stephenc version was built to avoid them. That, or I think if this is only annotations, we can just exclude it. Annotations shouldn't be required at runtime if they are not used at runtime (and these are for compile time).

[jbonofre]

Which one ? Not sure I follow you here 😄

[amogh-jahagirdar]

Findbugs (com.google.code.findbugs) I see some contents from META-INF but no actual classes in the bundle bits

     0 Fri Feb 01 00:00:00 MST 1980 META-INF/maven/com.google.code.findbugs/
     0 Fri Feb 01 00:00:00 MST 1980 META-INF/maven/com.google.code.findbugs/jsr305/
  4286 Fri Feb 01 00:00:00 MST 1980 META-INF/maven/com.google.code.findbugs/jsr305/pom.xml
   121 Fri Feb 01 00:00:00 MST 1980 META-INF/maven/com.google.code.findbugs/jsr305/pom.properties

I'd be +1 on excluding it.

[jbonofre]

Yes, it's what I see as well, but as I still see resources from jsr305 (even if very limited), I preferred to keep it.

[amogh-jahagirdar]

Sure, since these are compile time could we just exclude the bundling of this dependency entirely in the building of the shadowjar? Then we could just remove it entirely from LICENSE.

exclude(dependency('com.google.code.findbugs:jsr305'))

[jbonofre]

I agree. Let me clean it up. Even if gradle keeps pom it's not a problem.

[jbonofre]

Done

[rdblue]

The license of findbugs was unclear because of a reference to LGPL (see findbugsproject/findbugs#128). The implementation we use elsewhere was built to avoid the problem: https://github.com/stephenc/findbugs-annotations?tab=readme-ov-file#rational

[jbonofre]

@amogh-jahagirdar I removed the mention of jsr305.

@rdblue thanks for the details (LICENSE/NOTICE is a tricky work and often different view from everyone 😄 ). I removed jsr305 as it's excluded from the gcp-bundle jar.

[rdblue]

Looks mostly good, but I flagged an issue with removing the duplicates (I don't see that they are duplicating anything).

[amogh-jahagirdar]

Thanks @jbonofre, I think these changes look good now

[Fokko]

I think a few are missing from opentelemetry, but apart from that it looks good to me 👍

[jbonofre]

@rdblue I think I addressed all comments. Can you please do a new pass ? Thanks !

[Fokko]

Looks good, thanks again @jbonofre