FR: detect entirely unused classes

[iamdanfox]

What happened?

Currently, it is possible for products to accumulate entirely unused classes without any kind of static analysis failing. This recently caused a false positive when we are trying to assess the impact of a library breaking change elsewhere (we went to great lengths to preserve a method for a consumer only to find the consuming class was itself never used).

cc @robert3005

What did you want to happen?

The desired behaviour is a bit subtle depending on what the 'entry points' to a jar really are. For example:

• in test code, any floating class (public or package-private) that is not accessed by JUnit, and is never mentioned elsewhere can probably be deleted.
• when code is only published as a distribution (i.e. it's a server not a library), anything not reachable from a public static void main(String[] ...) should be deletable
• in java libraries, I think we'd need to be quite conservative... unreachable package-private classes are possibly the only deletable things here.

In all of these cases, we'd need to make sure we don't break reflection / service loading.

We might be able to just use ProGuard for this??