[nevzheng]

What changes were proposed in this pull request?

Gravitino gets a per-module report of dependencies it uses without declaring, or declares without using, and a ratchet so the count can only go down. Nothing fails today.

• Dependency Analysis Gradle Plugin 2.19.0 (the newest that runs on Gradle 8.2) on every module, every issue type at warn. Plain-java modules are analysed as app(); testFixtures is ignored.
• Per-module ratchet: checkBuildHealthBaseline reads the JSON report and fails only if a module has more findings than its entry in gradle/build-health-baseline.json. A module missing from the file is allowed 0, so new modules start clean.
• Baseline: today's count +10 %, rounded up (1,486 findings in 76 modules; baseline total 1,669). updateBuildHealthBaseline regenerates it, so a cleanup PR is "fix, then lower the number".
• CI: a separate build-health job, parallel to build and behind the same path filter. It writes a per-module table (findings, baseline, over / at / below) to the job summary and uploads the reports.
• Two build fixes the plugin needed: modules without sources are skipped, and iceberg-rest-server-experiment waits for the copyDepends task it shares an output folder with.

Why are the changes needed?

Modules compile against libraries they never declare, so a dependency upgrade can break them far away. Testcontainers 2 dropping junit:junit is the recent example (#14105). Today nothing reports it. This makes it visible per module and stops it from growing, without blocking anyone.

Part of #14106 (steps 1 and 2 of its plan).

Does this PR introduce any user-facing change?

No. Build and CI only.

How was this patch tested?

• buildHealth and checkBuildHealthBaseline pass on main; help, spotlessCheck and RAT pass.
• Raising one module above its baseline, and dropping one from the file, makes the check fail and name both modules.
• Local cost on a 14-core Mac: about 2 minutes for the analysis with compilation up to date, about 6 minutes from cold.