Exclude netty http modules from shading

[shakuzen]

We do not use HTTP in the StatsD registry implementation, so we would avoid some of the pain of false positive CVE detection on our shaded netty dependencies by excluding HTTP-related modules we don't use. This will also reduce the size of the statsd registry artifact.

See #2525

[shakuzen]

@violetagg would you mind letting me know if this seems reasonable? This branch is on reactor-netty 0.9.x and we don't use the HttpClient or any servers; only UdpClient/TcpClient. On our main branch, we plan to use reactor-netty-core when we upgrade to 1.0.x to avoid the HTTP stuff we don't use.

[violetagg]

@violetagg would you mind letting me know if this seems reasonable? This branch is on reactor-netty 0.9.x and we don't use the HttpClient or any servers; only UdpClient/TcpClient. On our main branch, we plan to use reactor-netty-core when we upgrade to 1.0.x to avoid the HTTP stuff we don't use.

That's exactly what was the reason for separating Reactor Netty on modules.

[stevefranchak]

Did #2588 undo excluding netty http codec modules, and, if so, was that intentional?

I updated micrometer-registry-statsd from 1.7.6 to 1.8.1 and noticed that io/micrometer/shaded/io/netty/handler/codec/http is being included in the JAR file. Previously, I was able to write off CVEs like CVE-2021-43797 as a false positive because the http modules weren't being included, but that's not possible for me to justify anymore if I update to micrometer-registry-statsd >= 1.8.0.