Cyb/vendor dependency

[alpass163gmail]

PR Description

Summary

This PR vendors the runtime sources of Guava 32.1.2-jre and Caffeine 2.9.3 into node-commons, allowing IoTDB-owned
modules to stop depending directly on the external Guava and Caffeine artifacts.

The implementation preserves existing APIs and runtime behavior by relocating packages and updating imports without
rewriting cache, collection, future, or concurrency logic.

Changes

• Vendored 624 Guava source files and 2 failureaccess source files.

• Vendored 581 Caffeine source files.

• Relocated packages:

  • com.google.common.* to org.apache.iotdb.google.common.*
  • com.google.thirdparty.* to org.apache.iotdb.google.thirdparty.*
  • com.github.benmanes.caffeine.* to org.apache.iotdb.github.benmanes.caffeine.*

• Replaced IoTDB source imports and fully qualified compile-time references with the relocated packages.

• Removed direct Guava and Caffeine dependencies from IoTDB modules.

• Removed Guava and Caffeine version management from the root POM.

• Kept library-udf as an explicit exception because it still uses the original com.google.common.math.Quantiles API.

• Replaced the two simple Guava usages in relational-grammar with JDK equivalents:

  • LinkedHashSet preserves insertion order.
  • Collections.unmodifiableSet preserves the immutable return contract.
  • A local nullToEmpty helper avoids introducing a dependency on node-commons.

Annotation Cleanup

The official source artifacts reference several annotation-only dependencies. Their annotations and imports were removed
from the vendored sources:

• Checker Framework
• Error Prone
• J2ObjC
• JSR-305

This does not remove explicit runtime validation such as requireNonNull or checkNotNull. Method bodies, signatures,
control flow, cache behavior, and exception handling remain unchanged. The removed annotations only affect static
analysis and non-JVM tooling metadata.

Build Rule Adjustments

Vendored third-party sources are now checked as IoTDB-owned source and bytecode, which exposed conflicts with project-
specific rules that did not previously scan external dependency JARs.

Checkstyle

Guava directly uses scheduleAtFixedRate and scheduleWithFixedDelay as part of its upstream scheduling implementation.
IoTDB normally requires these calls to go through ScheduledExecutorUtil.

A dedicated suppressions.xml was added and connected to the Maven Checkstyle plugin. It suppresses only the
unsafeThreadSchedule rule for relocated Guava sources while leaving all other Checkstyle rules enabled.

Forbidden APIs

IoTDB's secure-erase forbidden API rules reject legacy file APIs that may bypass SecureFileSystemProvider. Complete
Guava sources contain such calls in:

• org.apache.iotdb.google.common.io.Files
• org.apache.iotdb.google.common.io.FileBackedOutputStream

These classes are excluded from the forbidden API scan to keep the upstream Guava implementation unchanged. All other
project and vendored classes remain covered by the check.

Compatibility

• Existing IoTDB method calls, parameters, return handling, and call order are preserved.
• No custom replacements for Guava or Caffeine runtime behavior were introduced.
• Caffeine eviction, expiration, statistics, loading, and dynamic policy behavior continue to use the upstream
  implementation.
• Third-party JAR bytecode was not modified.
• Ratis-shaded Guava references remain unchanged.
• library-udf continues to use the original Guava dependency intentionally.

Verification

Static verification confirmed:

• 626 relocated Guava and failureaccess Java files.
• 581 relocated Caffeine Java files.
• No remaining original Caffeine references in IoTDB sources.
• Original Guava references remain only for the documented library-udf exception and Ratis-shaded packages.
• Vendored sources contain no remaining Checker Framework, Error Prone, J2ObjC, or JSR-305 imports.
• Maven dependency cleanup retains only the intentional library-udf Guava dependency.