Open-API: Stop publishing REST fixture runtime jar

[kevinjqliu]

Summary

Stop publishing the OpenAPI REST fixture as a shaded runtime jar. Docker now uses :iceberg-open-api:stageRESTFixtureRuntime to stage the test-fixtures jar, runtime dependencies, LICENSE, and NOTICE under open-api/build/iceberg-rest-server/, then launches RESTCatalogServer with java -cp.

I'll follow up with another PR to fix the content of the LICENSE/NOTICE files

Changes

• Remove the OpenAPI Shadow plugin and runtime shadowJar.
• Keep Docker runtime staging out of normal :iceberg-open-api:build.
• Update Docker, CVE scan, and README references to the staged runtime task.
• Keep the published testFixturesJar for test consumers, with standard archive metadata.

Testing

• ./gradlew :iceberg-open-api:stageRESTFixtureRuntime
• ./gradlew :iceberg-open-api:build --dry-run
• docker build + docker run smoke test: container became healthy and /v1/config returned endpoints.

[kevinjqliu]

this is ready for first round of review.

Please take a look at build.gradle, .github/workflows/publish-iceberg-rest-fixture-docker.yml, docker/iceberg-rest-fixture/Dockerfile
and then open-api/runtime-deps.txt and runtime-deps.gradle

once those are good, please check open-api/LICENSE and open-api/NOTICE

[manuzhang]

I'm wondering whether we need all those jars and bundles for docker image and integration tests in iceberg-python and iceberg-rust.

[kevinjqliu]

After this, I will follow up with more PRs to

1. Prune as many unnecessary dependencies as possible from the rest fixture image
2. Fix the LICENSE/NOTICE file

[github-actions]

This pull request has been marked as stale due to 30 days of inactivity. It will be closed in 1 week if no further activity occurs. If you think that’s incorrect or this pull request requires a review, please simply write any comment. If closed, you can revive the PR at any time and @mention a reviewer or discuss it on the dev@iceberg.apache.org list. Thank you for your contributions.

[github-actions]

This pull request has been closed due to lack of activity. This is not a judgement on the merit of the PR in any way. It is just a way of keeping the PR queue manageable. If you think that is incorrect, or the pull request requires review, you can revive the PR at any time.