Isolate plugin classpaths from ORT's classpath

[sschuberth]

Even with plugins being separate Gradle projects (see #6602), in the end when running ORT via scripts generated by Gradle's Java Application Plugin everything ends up in a single classpath. That is problematic as different plugins / core tools of ORT might require different versions of the same dependency. This is already the case with the Bundler analyzer and the PdfTemplateReporter that both depend on JRuby (versions 9.4.2.0 and 9.3.8.0 respectively), and forcing them to use the same JRuby version causes weird issues.

A proper solution would probably be to build all plugins as fat-JARs and not put them on the application classpath by default, but using a URLClassLoader that inherits from the application classloader, and pass that to ServiceLoader.load().

[sschuberth]

Here's an article about basically exactly that idea: https://medium.com/geekculture/designing-a-lightweight-plugin-architecture-in-java-5eedfeaa92a9

[sschuberth]

Another short-term solution would be to rewrite all dependencies of plugins via Shadow and create fat JARs for plugins.

[sschuberth]

While having it on my radar, it seems I haven't linked to https://github.com/pf4j/pf4j explicitly yet.