Add missing ASF license headers and check them with Apache RAT

[mraible]

About 140 Roller-owned files were missing the ASF license header: Java sources and tests (mostly package-info.java files), JSPs, Velocity templates, Struts validation and menu XML, the ORM mappings and persistence.xml, taglib.tld, properties files, deployment descriptors, test DB scripts, the example code under docs/examples, sign-release.sh, the CodeQL configs, db-utils/pom.xml, version-rules.xml, and the NetBeans nbactions.xml files. Seven test classes used a shortened ASF notice and now have the full header. Each file gets the header in the comment style its neighbors already use.

To keep it that way, the apache-rat-plugin 0.18 is configured in the parent pom (not bound to the build, since it is slow; run mvn apache-rat:check), and a new "License headers" job in the workflow runs it on every push and PR. Its exclusions are commented in the pom.

Velocity templates need care because comments sit in rendered output:

• Templates that emit markup or feeds (rsd.vm, popupcomments.vm, noop_decorator.vm, the menu and navbar templates) put the closing *# directly in front of their first output, the pattern the feed templates already use, so nothing they render changes.
• Templates that begin with a directive or comment get a line break after the header, since *## would turn the next line into a line comment. For the SQL templates this adds one blank line to each generated script, which SQLScriptRunner skips.

I compared the generated database scripts before and after: they differ only by that blank line. All unit tests pass.

Excluded from RAT on purpose:

• docker/wait-for-it.sh, the jQuery Mobile theme CSS, and roller-ui/scripts/jquery-2.1.1.min.js are third-party code with their own licenses.
• The bundled blog themes and the starter templates in src/main/resources/themes have never carried headers because they are copied into users' editable weblog templates.
• Prose documentation (*.md, *.adoc), images, word lists and other data files, and the generated JMeter plan.

[mbien]

we could let CI check this, e.g:

            <plugin>
                <groupId>org.apache.rat</groupId>
                <artifactId>apache-rat-plugin</artifactId>
                <version>0.18</version>
                <configuration>
                    <inputExcludes>
                        <inputExclude>/src/main/webapp/themes/*</inputExclude>
                        <inputExclude>/src/main/webapp/favicon*</inputExclude>
                        <!-- more -->
                    </inputExcludes>
                </configuration>
            </plugin>

plugin is off by default since it makes the build a bit slower, run with apache-rat:check.

[mraible]

Good idea, done. The apache-rat-plugin 0.18 is in the parent pom's pluginManagement, not bound to the build, so mvn apache-rat:check runs it, and a new "License headers" job in the workflow runs that check on every PR.

RAT caught files my first pass missed, which now have headers: the weblogger ORM mappings, persistence.xml, taglib.tld, context.xml-example, the dummy test DB scripts, and the docs/examples code. It also rejected the shortened ASF notice seven test classes used, so those have the full header now.

The exclusions are commented in the pom: prose docs (*.md, *.adoc), the bundled themes and the starter templates in src/main/resources/themes, SVGs, third-party code (wait-for-it.sh, jQuery Mobile's CSS, the old jquery-2.1.1.min.js), data files like the word lists and the OPML sample, and the generated JMeter plan. apache-rat:check passes on all three modules.

[snoopdave]

LGTM. let's merge this