refactor(oss-licenses): replace eager dependency resolution with lazy ArtifactView providers

[timothyfroehlich]

Summary

This PR refactors the oss-licenses-plugin to fully support the Gradle Configuration Cache by replacing eager configuration-phase dependency resolution with lazy ArtifactView providers. It also introduces SHA-256 hashing for -SNAPSHOT dependencies to ensure license data remains fresh during active development.

Key Changes

• Lazy ArtifactView Resolution: Moved dependency resolution from the configuration phase to the execution phase using lazy ArtifactView and resolvedArtifacts providers.
• Configuration Cache Support:
  • Removed DependencyUtil and ArtifactFiles.
  • Rewrote property mapping to avoid capturing the Project object in closures by extracting necessary handlers (like DependencyHandler) into local variables. This avoids "cannot serialize object of type DefaultProject" errors.
  • Switched from @Nested MapProperty<String, ArtifactFiles> to isolated @Internal MapProperty<String, File> inputs to optimize hashing and ensure compatibility.
• Snapshot Integrity: Added SHA-256 hashing for dependencies with -SNAPSHOT versions in DependencyTask. This hash is included in the dependencies.json report, forcing LicensesTask to re-run if a snapshot is re-published with changes.
• Bug Fixes:
  • Fixed an incorrect reference to EMPTY_ARTIFACT (now ABSENT_ARTIFACT) in error messages.
  • Downgraded "POM file does not exist" logs from error to info to reduce noise from expected missing metadata in some libraries (e.g., androidx, org.jetbrains).
• Improved Testing:
  • Added testSnapshotChangeTriggersExecution to verify the "Change Snapshot -> Re-run Task" cycle.
  • Added DependencyTaskTest.testAction_snapshotVersions_includeHashes to verify correct SHA-256 calculation.
  • Updated EndToEndTest.testConfigurationCache to assert that no configurations are resolved during the configuration phase.

Verification Results

• All unit tests and E2E tests passed across multiple AGP versions (7.4 to 9.2-alpha).
• Verified Configuration Cache compatibility with strict mode enabled (problems=fail).

[timothyfroehlich]

@liutikas I did a full rewrite to get things right and managed to significantly simplify things in the process. The Licenses task now separate arguments consisting of the runtimeConfiguration's resolvedArtifacts provider, with artifact resolution happening within the .map lambda. I also added a check in the configuration cache test to make sure we aren't resolving anything during configuration time.

I did use Gemini to help me get it straight, and had it add comments to help me (or other maintainers) remember for next time. I'm running an extra --scan now to double check things, but it should be pretty clean.

[liutikas]

I'm out of office for a week. I'll review this when I get back