add sbt-whitesource

[SethTisue]

also add jansi dependency for WhiteSource; it's shaded in the JLine
jar, so WhiteSource doesn't know about it unless we tell it

note that this version of sbt-whitesource respects 'skip in publish'

this is the 2.13.x version of the 2.12.x PR #8167

[dwijnand]

LGTM

But I'm not sure why you opt for a separate top-level .sbt file.

[SethTisue]

I'm not sure why you opt for a separate top-level .sbt file

I'll change that

[SethTisue]

if I considered it at all, I must have thought that declaring the dependency as "optional" would prevent this, but Lukas and I noticed the other day that this caused an unintended change where in the distribution, the lib directory in 2.13.1 includes jansi.jar, though it didn't before. I don't think the extra JAR is used (the jline JAR has shaded jansi classes right there inside it) so it probably isn't causing any harm except consuming disk space, but I wanted to comment for the record anyway.

I would fix it, except that it seems very likely now that the JLine 3 PR (#8036) will land for 2.13.2, at which point we'll actually be using a separate jansi JAR anyway.