KAFKA-17798: Add forbidden-apis linting to gradle build

[nmarasoiu]

Integrates the forbidden-apis Gradle plugin to scan bytecode for invocations of unsafe or deprecated API methods.

Changes

• Add forbidden-apis plugin (v3.10) to gradle build
• Configure with jdk-unsafe and jdk-deprecated bundled signatures
• Set ignoreFailures = true initially (warnings only, no build failure)
• Hook into test task via test.dependsOn('forbiddenApisMain')
• Document usage in README.md

Why ignoreFailures = true?

Running the check reveals dozens/hundreds of existing violations (mostly locale-dependent String.format() calls). Fixing these should be separate PRs. This PR establishes the infrastructure; follow-up issues KAFKA-17799 and KAFKA-17800 will add specific rules and address violations.

Testing

./gradlew :clients:forbiddenApisMain # runs check, reports warnings, build succeeds ./gradlew tasks --all | grep forbidden # shows tasks registered for all subprojects

Related

• Blocks: KAFKA-17799, KAFKA-17800
• Previous PR #17565 was auto-closed due to inactivity