Fix reproducible build issues with 7.0.0

[adangel]

Describe the PR

For the latest release 7.0.0, not all artifacts are reproducible:

• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/README.md
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/pmd-7.0.0.buildcompare

15 files are not reproducible. This PR fixes these.

1. The BOM for the parent POM created by cyclonedx contains all modules. However, due to the cyclic dependency between pmd and pmd-designer (see Circular dependencies between pmd-ui, pmd-core, pmd-cli #4446) we do the release in two phases: first without pmd-cli/pmd-dist and in the 2nd phase only pmd-cli/pmd-dist. In the first phase, the parent POM is published and the BOM doesn't contain pmd-cli/pmd-dist. This PR now always excludes these two modules from the BOM, so that the whole project can be reproduced without doing the reproducible build in two phases as well.
2. When generating the tokenizers/parsers with javacc, we use maven-antrun-plugin to run some ant script that does some replaceregexp on files. When ant does this, it first performs the replaceregex on a temporary file with limited file permissions (like having umask 077). These files are then packed into the source jar by maven-source-plugin. In the older version of that plugin (3.2.1 used by PMD 7.0.0-rc4), these limited file permissions have obviously been ignored and all the files in the archive had the correct permission. The upgrade of maven-source-plugin to 3.3.0 changed to preserve the file permission (as opposed to reapply the umask for the files in the archive). Ant has a fix for the tasks, that create a temporary file, to preserve the permissions of the original file, so that the permissions in the archive are now correct. This PR now updates the ant version used by maven-antrun-plugin to use this fix.

Related issues

• None

Ready?

• Added unit tests for fixed bug/feature
• Passing all unit tests
• Complete build ./mvnw clean verify passes (checked automatically by github actions)
• Added (in-code) documentation (if needed)

[pmd-test]

	1 Message
📖	No regression tested rules have been changed.

Generated by 🚫 Danger