Migrate to version catalog

[StefMa]

:scroll: Description

Migrate most of the dependencies from the Dependencies.kt file into Gradles version catalog. Basically fixes https://github.com/getsentry/sentry-android-gradle-plugin/issues/486

For include/composite builds I added a symlink to share literally anything in a single libs.versions.toml file.

Unfourtnaly, the I can't move anything. Thre is still stuff left in Dependencies.kt. Most noteworthy the BuildPluginsVersion.AGP (which is fine IMHO), but also the Libs.PROGUARD. I can't remove them and still need sometimes the buildscript block because the gradle files are in groovy and it seems there is no possibility to use the BuildPluginsVersion.AGP from a groovy script.. 🤔 Didn't worked for me.

:bulb: Motivation and Context

As mentioned, this fixed https://github.com/getsentry/sentry-android-gradle-plugin/issues/486 Just wanted to tackle this 🤷 🙃

:green_heart: How did you test it?

Since this is about dependency mangament basically any task would reveal if everything is correct as dependency stuff happen on configuration time. However, I also create my own fork and created a PR to check stuff. See https://github.com/StefMa/sentry-android-gradle-plugin/pull/1

Only the matrix builds failing because of the lack of a SENTRY_AUTH_TOKEN.

To note also: Gradle 7.0.4 does not work because we have to enable the featurePreview("VERSION_CATALOGS"). I'm not sure if it worth it to add or just drop this test case. This Gradle version is quite old, but this is not my decision 🙃

:pencil: Checklist

• [ ] I reviewed the submitted code
• [ ] I added tests to verify the changes
• [ ] I updated the docs if needed
• [ ] No breaking changes

:crystal_ball: Next steps

[StefMa]

@markushi

The tests failing with

Unrecognized auth token format!

secrets are not available for PRs. See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#accessing-secrets In your workflow file you're using SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}.

A potential workaorund would be to use pull_request_target in combination of checking out the PR branch. In combination with required reviewers it might somewhat safe 😅 See also https://github.com/orgs/community/discussions/50161#discussioncomment-5824158