Add shaded artifact (classifier "shaded") with relocated dependencies

[bertysentry]

Summary

Attaches a second artifact — winrm-java-<version>-shaded.jar (classifier shaded) — in which all dependencies are relocated under org.metricshub.winrm.shaded.*, so embedding winrm-java cannot clash with, or leak ServiceLoader/JAXP registrations into, the host application's classpath. The regular thin JAR is unchanged; existing consumers are unaffected.

Why

Investigating a customer-reported WinRM failure in MetricsHub Enterprise (see MetricsHub/metricshub-community#1271) showed how fragile a flat classpath is around this library:

• winrm-java's own tree pollutes the host: Woodstox registers itself as the JVM-wide default XMLInputFactory for every other component on the classpath.
• The host can pollute winrm-java: version clashes on CXF/HttpClient/JAXB are one mvn dependency away.

The shaded artifact fixes both directions of classpath interference. Note what it does NOT fix: JAXP factory poisoning through DocumentBuilderFactory.newInstance() (e.g. Oracle xmlparserv2, the root cause in the linked issue) is a JDK-global lookup that no amount of relocation can shield — verified experimentally. That requires the classloader isolation proposed in the linked issue (or pinning the JAXP factories via system properties).

Design notes

• ServicesResourceTransformer renames and rewrites META-INF/services files to the relocated names (JAXB, SAAJ, JAX-WS, CXF bus factory all resolve within the shaded namespace).
• META-INF/cxf/bus-extensions.txt lists class names as plain text, which relocation does not rewrite — the jar ships a pre-relocated merged copy of all cxf-* module entries (src/main/shade/bus-extensions.txt); originals are filtered out. (Fun fact: cxf-rt-ws-addr's copy has no trailing newline — naive concatenation silently corrupts the merge.)
• javax.xml.stream.* service files are dropped — the shaded jar must not claim the JVM-wide StAX default inside host applications; CXF falls back to the JDK StAX implementation.
• Kept external (documented in the README): org.slf4j:slf4j-api (host controls logging; the embedded, relocated jcl-over-slf4j backs the shaded HttpClient's commons-logging and routes to the host's slf4j) and org.bouncycastle:bcprov-jdk18on (signed JCE provider — repackaging would break it).
• jakarta.servlet.* service files from jaxws-rt are excluded so the jar cannot register into host servlet containers.

Verification

• mvn verify: 31/31 tests pass, prettier/checkstyle/pmd clean.
• Isolated smoke test with only the shaded jar + slf4j + bcprov on the classpath: WinRMService.createInstance() (WSDL parse, JAX-WS catalog, CXF client build) succeeds, and executeWql() against a nonexistent host runs the full stack — JAXB serialization, SAAJ, NTLM encryption interceptors, async HTTP conduit — down to a clean UnknownHostException at the DNS layer. No unrelocated third-party classes remain in the jar.
• Jar hygiene audited: every META-INF/services entry is either relocated or belongs to winrm-java.

Usage (for MetricsHub extensions)

See the new README section: depend on the shaded classifier with a wildcard exclusion, plus explicit slf4j-api and bcprov-jdk18on.

🤖 Generated with Claude Code

[bertysentry]

Trimmed the shaded artifact 14.5 MB → 10.6 MB by excluding runtime-dead artifacts: Metro (jaxws-rt — a second, unused JAX-WS runtime; CXF is the implementation) with its satellites (gmbal, ha-api, management-api, streambuffer, FastInfoset, duplicate com.sun.xml.bind JAXB), and jakarta.mail/angus-mail (MTOM/attachments only — unused by WinRM).

Woodstox must stay: CXF refuses to create a secure XMLInputFactory without it (verified — dropping it fails with Cannot create a secure XMLInputFactory). It remains relocated and unregistered, so it stays invisible to host applications.

Deliberately NOT using minimizeJar: CXF loads most of its classes reflectively (bus-extensions.txt, service files), so static-reachability minimization would strip live code; protecting it with include filters would cover most of the jar anyway. What remains (CXF ~3.3 MB, Woodstox 1.8 MB, HttpClient stack 1.6 MB, JAXB 1.1 MB, smbj, SAAJ) is all genuinely exercised.

Same verification as before: isolated smoke test passes (full stack to the network layer), 31/31 tests, jar hygiene clean.