Exclude jsr305 from SQL bundle to fix jar hell with arrow-flight-rpc

[ahkcs]

Summary

The SQL plugin currently fails to install on top of analytics-engine + arrow-flight-rpc with:

IllegalStateException: jar hell!
class: javax.annotation.CheckForNull
jar1: .../installing-.../jsr305-3.0.2.jar
jar2: .../plugins/arrow-flight-rpc/jsr305-3.0.2.jar
    at org.opensearch.common.bootstrap.JarHell.checkClass(JarHell.java:316)
    at org.opensearch.plugins.PluginsService.checkBundleJarHell(PluginsService.java:792)

arrow-flight-rpc (a transitive parent of analytics-engine via extendedPlugins) bundles jsr305-3.0.2.jar, and the SQL plugin currently bundles the same artifact. With both plugins shipping the same jar, PluginsService.checkBundleJarHell rejects the SQL install.

This PR excludes jsr305-*.jar from the SQL bundle so the arrow-flight-rpc copy (already on the shared classloader) is the only one on disk. Same pattern as #5400.

Stop-gap until #5403 lands

This is a band-aid. The real fix is #5403 (open against the same base branch), which makes analytics-engine an optional extendedPlugins dependency via the supported ;optional=true syntax:

• PluginInfo.java:190-191 — parses optional=true off the extendedPlugins entry
• PluginsService.java:794-796 — checkBundleJarHell skips the cross-check entirely when the dependency is optional

Once #5403 merges, the entire bundlePlugin { exclude '<artifact>-*.jar' } block at plugin/build.gradle:67-107 becomes obsolete and this whole class of breakage stops happening on every analytics-engine zip bump. So if #5403 lands first, please close this PR rather than merging it; if this lands first, it can be reverted as part of #5403's diff.

Test plan

• ./gradlew :plugin:bundlePlugin and confirm the resulting zip no longer contains jsr305-3.0.2.jar
• Install arrow-flight-rpc + analytics-engine + this SQL build on a local OpenSearch 3.7 node and confirm bin/opensearch-plugin install succeeds
• Smoke-test a PPL query end-to-end on the analytics-engine path to confirm javax.annotation.* classes still resolve at runtime via the shared classloader

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit e92c6fc.

Path	Line	Severity	Description
plugin/build.gradle	104	high	Modification to the bundlePlugin build plugin configuration (mandatory flag: build plugin change). Specifically, 'jsr305-*.jar' is excluded from the plugin bundle. The accompanying comment explains this as a jar-hell avoidance fix when co-existing with arrow-flight-rpc, which is a plausible and legitimate rationale. Maintainers should verify that this exclusion does not cause runtime NoClassDefFoundError or similar failures if jsr305 is referenced by code paths where the parent plugin's copy is not available, and confirm the change is intentional.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.