[hj690]

Summary

Configures google-api-java-client so builds and releases against Airlock (maven-3p-trusted) only resolve approved dependencies:

1. Move clirr-maven-plugin to an opt-in clirr-compatibility-check profile (pom.xml, .kokoro/build.sh):
   • clirr-maven-plugin:2.8 pulls in 10 legacy POMs and JARs (bcel:5.1, regexp:1.2, dom4j:1.6, jaxen:1.1-beta-4, jdom:b10, xalan:2.5.0, xercesImpl:2.6.2, xom:1.0b3, icu4j:2.6.1, plexus-components:1.1.4) that lack approved licenses in maven-3p-trusted.
   • Moves the clirr:check execution into a clirr-compatibility-check profile and enables -Pclirr-compatibility-check when JOB_TYPE=clirr in .kokoro/build.sh.
2. Override plexus-i18n and antlr in findbugs-maven-plugin and maven-bundle-plugin (pom.xml):
   • findbugs-maven-plugin:3.0.5 and maven-bundle-plugin:5.1.9 pull in plexus-i18n:1.0-beta-7 and antlr:2.7.2 via doxia-site-renderer.
   • Overrides both plugins to use plexus-i18n:1.0-beta-10 (with *:* exclusions for legacy Plexus container artifacts provided by Maven core) and antlr:2.7.7, which maven-3p-trusted includes.
3. Exclude evicted org.osgi:org.osgi.core:4.1.0 in maven-bundle-plugin (pom.xml):
   • maven-bundle-plugin:5.1.9 directly depends on org.osgi:org.osgi.core:6.0.0, which evicts the 4.1.0 transitive dependency declared by org.apache.felix.bundlerepository:1.6.6 and org.apache.felix.utils:1.6.0.
   • Excludes org.osgi:org.osgi.core on both Felix dependencies so Maven does not probe the evicted 4.1.0 stub POM (which lacks license metadata in Airlock).
4. Exclude unused xerces:xmlParserAPIs:2.6.2 from com.google.android:android (google-api-client-android/pom.xml):
   • Excludes xerces:xmlParserAPIs from com.google.android:android:4.1.1.4 (provided scope), since the JDK provides these XML APIs and xmlParserAPIs:2.6.2 lacks license metadata in Airlock.