Ban com.google.code.findbugs:jsr305 unconditionally

[ppalaga]

com.google.code.findbugs:jsr305 a pure dev UX dependency that might be useful when compiling code containing those annotations, but is completely useless when it is only a transitive dependency.
We exclude it where we can in Camel Quarkus, but we still need to fix some holes.
I guess it would be useful to ban it on the platform level so that no participant can smuggle it in.

Related: https://issues.redhat.com/browse/QUARKUS-1461

[ppalaga]

While this is doable for Camel Quarkus apache/camel-quarkus#3337 , it is not that straightforward for Quarkus: findbugs is required not only to compile quarkus-grpc, but also it is required by user apps when the grpc codegen does its work.

[ppalaga]

So findbugs definitely needs to stay managed by Quarkus.

I just found out that it is managed in quarkus-build-parent rather then quarkus-bom. I think quarkus-bom would be a better place to manage it so that the alignment is effective also for the platform and thus for all user apps.

[ppalaga]

I have sent quarkusio/quarkus#21716 closing this one.