Remove nimbus shadow jar (#133602) (#133613)

This shadow jar was necessary for SecurityManager due to its use of
gson libraries. However, now that entitlements has replaced security
manager, it is no longer needed.

Author: rjernst

x-pack/plugin/security/build.gradle

@@ -81,14 +81,7 @@ dependencies {
   // Dependencies for oidc
   api "com.nimbusds:oauth2-oidc-sdk:11.22.2"
   runtimeOnly "com.nimbusds:content-type:2.3"
-  api project(path: xpackModule('security:lib:nimbus-jose-jwt-modified'), configuration: 'shadow')
-  if (isEclipse) {
-    /*
-     * Eclipse can't pick up the shadow dependency so we point it at the unmodified version of the library
-     * so it can compile things.
-     */
-    api "com.nimbusds:nimbus-jose-jwt:10.0.2"
-  }
+  api "com.nimbusds:nimbus-jose-jwt:10.0.2"
   api "com.nimbusds:lang-tag:1.7"
   api "com.sun.mail:jakarta.mail:1.6.8"
   api "net.jcip:jcip-annotations:1.0"
@@ -185,6 +178,7 @@ tasks.named("dependencyLicenses").configure {
   mapping from: /bc.*/, to: 'bouncycastle'
   mapping from: /failureaccess.*/, to: 'guava'
   mapping from: 'content-type', to: 'nimbus'
+  mapping from: /nimbus.*/, to: 'nimbus'
 }
 
 tasks.named("forbiddenPatterns").configure {
@@ -387,6 +381,16 @@ tasks.named("thirdPartyAudit").configure {
     'org.bouncycastle.util.Arrays',
     'org.bouncycastle.util.io.Streams',
     'org.bouncycastle.cert.X509CertificateHolder',
+    // missing classes linked by nimbus
+    'com.google.crypto.tink.subtle.Ed25519Sign',
+    'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
+    'com.google.crypto.tink.subtle.Ed25519Verify',
+    'com.google.crypto.tink.subtle.X25519',
+    'com.google.crypto.tink.subtle.XChaCha20Poly1305',
+    'org.bouncycastle.cert.jcajce.JcaX509CertificateHolder',
+    'org.bouncycastle.openssl.PEMKeyPair',
+    'org.bouncycastle.openssl.PEMParser',
+    'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter'
   )
 
   ignoreViolations(