[improve][build] Add validated API/SPI publication subset

[lhotari]

Motivation

Custom builds of the Pulsar Java clients, Functions and plugins need a complete set of API/SPI artifacts in the target Maven repository. Publishing the entire Pulsar project is unnecessary for this use case, while manually listing publish tasks can omit transitive dependencies. A custom Maven group also requires the BOM and internal published dependencies to use the same coordinates.

Modifications

• Add -PpublishApiAndSpiOnly=true with an explicit selection of 45 projects, including the ordinary and v5 Java clients and the dependencies needed for Functions and plugins.
• Validate generated POMs and Gradle Module Metadata before publication, rejecting internal dependencies outside the selection or with incorrect coordinates. Filter the BOM to selected projects in this mode.
• Honor custom groups in parent POMs, publication-only dependency replacements, Functions shading and NAR platform exclusions.
• Add a CI check of subset dependency closure under a custom group, alongside the existing ordinary publication check.
• Document ordinary and custom publishing, credentials, versions and consumer dependency substitution in build-logic/PUBLISHING.md.

Verifying this change

• Make sure that the change passes the CI checks.

Added five TestNG tests for publication dependency validation, using the existing TestNG catalog dependency in build logic.

Local verification passed:

• ./gradlew spotlessCheck checkstyleMain checkstyleTest and quickCheck.
• ./gradlew -p build-logic :conventions:test.
• Local publication of the API/SPI subset under a custom group and validation of all 45 publications.
• Temporarily removing pulsar-common from the selection fails validation with missing dependencies in POMs and Gradle metadata; restoring it passes.
• Ordinary and subset configuration-cache reuse with configure-on-demand enabled; clean client compilation restored from the build cache across modes.
• Switching ordinary → subset → ordinary produces 48 → 37 → 48 BOM constraints in both metadata formats.
• Resolved Functions shading and NAR platform dependency filtering with default and custom groups.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency): add the existing TestNG dependency to build-logic tests; filter published artifacts and BOM constraints only in the opt-in subset mode.
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment