Ship only bundleReplacements targets in distributions

[jaymcnallie]

etc/org.apache.karaf.features.xml uses bundleReplacements to converge third-party pins on DDF's versions, but Karaf applies them only at install time. features-add-to-repository still staged the pinned originals, and some replacement targets were never staged.

Jackson

• Missing targets (offline installs fail): jackson-dataformat-yaml, jackson-jaxrs-base and jackson-jaxrs-json-provider at ${jackson.version} were never in system/, so Karaf downloaded them from Maven Central or ~/.m2. With no network, profile:install standard failed with Could not find artifact ... jackson-jaxrs-base:jar:2.22.3. The kernel zip had no 2.22.3 Jackson at all.
• Stale versions: 2.18.10, 2.21.1, 2.22.1 and 2.22.2 (pinned by Karaf, pax-web and CXF features) shipped but can never load.

BouncyCastle and commons-text

• bcprov/bcpkix/bcutil 1.83 (pax-web keycloak-adapter-core) and commons-text 1.8 (Shiro shiro-core) shipped but are never installed. New replacements: BouncyCastle [1.80,2) -> ${bouncy.version}, commons-text [1,2) -> ${commons-text.version}.

Changes

• etc/org.apache.karaf.features.xml: BouncyCastle and commons-text replacements
• features/kernel: staging-only bundle-replacements feature with every replacement target
• distribution/pom.xml: prune-replaced-bundles antrun execution deletes replaced versions before assembly and fails the build if a target is missing; used by kernel (inherited by ddf) and ddf-catalog

Verified

• kernel, ddf-catalog and ddf zips each contain exactly one version of each replaced artifact
• guard fails the build when a target is missing
• offline (no remote repos, empty local repo): profile:install standard completes with no resolution errors; jackson/2.18.10, jackson-jaxrs/2.22.2, keycloak-adapter-core and shiro-core/2.2.1 also install and resolve to the replacement versions
• Trivy: Jackson findings 34 -> 0, BouncyCastle/commons-text 7 -> 0 (3 critical)