Duplicate jars in packaged versions

[wetneb]

We ship a lot of duplicate .jar files in our releases.

I ran find . | grep -P "\.jar" | sed -e "s:.*/::g" |less | sort | uniq -c | grep -vP "^ *1 " and got:

      2 butterfly-1.2.5.jar
      3 checker-qual-3.42.0.jar
      3 commons-codec-1.16.1.jar
      2 commons-collections-3.2.2.jar
      2 commons-compress-1.26.1.jar
      3 commons-io-2.16.0.jar
      2 commons-lang-2.6.jar
      3 commons-lang3-3.14.0.jar
      3 error_prone_annotations-2.26.1.jar
      3 failureaccess-1.0.2.jar
      2 gson-2.10.1.jar
      3 guava-33.1.0-jre.jar
      3 httpclient-4.5.14.jar
      3 httpclient5-5.3.1.jar
      3 httpcore-4.4.16.jar
      3 httpcore5-5.2.4.jar
      3 httpcore5-h2-5.2.4.jar
      3 j2objc-annotations-3.0.0.jar
      2 jcl-over-slf4j-1.7.36.jar
      2 jetty-http-10.0.16.jar
      2 jetty-io-10.0.16.jar
      2 jetty-util-10.0.16.jar
      3 jsr305-3.0.2.jar
      2 lessen-1.0.jar
      3 listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
      8 localizer-1.31.jar
      2 opencensus-api-0.31.1.jar
      2 opencensus-contrib-http-util-0.31.1.jar
      2 oro-2.0.8.jar
      2 rhino-1.7.14.jar
      2 velocity-1.6.3.jar

For most of these, we should be able to eliminate the duplication by making sure they are only loaded in the most primitive module (server > main > any extension).