this lets us get rid of shadow, which
1) lets hub plugins bring their own shadow if they desire without
impacting the build process
2) removes a vulnerable log4j from the build process. This isn't
a huge issue to us because if you can get arbitrary files into the
shadow jar, security is already compromised, so at worst this lets
you escalate
we have to do this as part of a compiler plugin, and not by just looking
at the classes' bytecode, because jls§13.1 requires inlining of certain
constant values, so references to these will not be present in the
bytecode.
not using bash gives us more flexibility and significantly reduces build
times via parallelism. Additionally this includes support for GitHub
Actions which also significantly reduces build times.
