Simplify Android release support by including a jar directly

[jrose-signal]

The crate-local Maven repository didn't work for Signal because we use rustls-platform-verifier in a library, and our main app doesn't know about Rust at all. We determined that as long as no other library is using rustls-platform-verifier, and as long as rustls-platform-verifier's Java/Kotlin side doesn't need anything but its classes, we can slurp those classes into our library directly and everything will be fine. (And indeed, it is working for us.)

This may have some downsides for general use (the main one being that files(…) dependencies can't have metadata), but given how minimal the crate-local Maven repository is, I'm not sure they'll come up in practice. So maybe this is a simpler approach for future versions of the crate?

dependencies {
    implementation files(findRustlsPlatformVerifierClasses())
}

File findRustlsPlatformVerifierClasses() {
    def dependencyText = providers.exec {
        it.workingDir = new File("../")
        commandLine("cargo", "metadata", "--format-version", "1")
    }.standardOutput.asText.get()

    def dependencyJson = new JsonSlurper().parseText(dependencyText)
    def manifestFile = file(dependencyJson.packages.find { it.name == "rustls-platform-verifier-android" }.manifest_path)
    return new File(manifestFile.parentFile, "classes.jar")
}

[djc]

Cool to see that Signal is starting to use rustls-platform-verifier!

I don't have all the context here, but you might like to read through the discussion in #32.

[Hinton]

We're also running into this issue as we distribute an android library and the consumers have understandably difficulties resolving rustls:rustls-platform-verifier:latest.release. Most likely we'll follow a similar path to above and ship the library bundled.