[SUREFIRE-1802] improve Reproducible Builds after Surefire 3.0.0-M5 release

**[Hervé Boutemy](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hboutemy)** opened **[SUREFIRE-1802](https://issues.apache.org/jira/browse/SUREFIRE-1802?redirect=false)** and commented

Surefire 3.0.0-M5 was released with build enhancements that sould make the build reproducible: results are good but not perfect

the good part: the release manager (Tibor) is able to rebuild on his local environment and get the full set of artifacts exactly as they are published to Central

the not perfect part: trying to reproduce independantly shows a few issues that are build with a little difference to the reference artifacts from Central

see https://github.com/jvm-repo-rebuild/reproducible-central for automated rebuild script, that when run on my own machine give followinf results: https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/maven/surefire/surefire-shared-utils-3.0.0-M5.buildinfo.compare
* the build produces 45 artifacts exactly like reference in Central
* 5 artifacts are not produced exactly like the reference in Central:
* surefire-shadefire-3.0.0-M5.jar
* maven-surefire-plugin-3.0.0-M5.jar
* maven-failsafe-plugin-3.0.0-M5.jar
* maven-surefire-plugin-3.0.0-M5-sources.jar
* maven-failsafe-plugin-3.0.0-M5-sources.jar

We need to investigate how to make the build more independant from the environment, discovering how the environment impacts

First level of investigation shows that there are 2 issues: SUREFIRE-1803 (DEPENDENCIES) and SUREFIRE-1804 (shading)
and one additional nice to have MASFRES-34 (dependency-reduced-pom.xml)

---

**Affects:** 3.0.0-M5

**Sub-tasks:**
- [SUREFIRE-1803](https://issues.apache.org/jira/browse/SUREFIRE-1803) fix reproducibility fragility of DEPENDENCIES generation

- [SUREFIRE-1804](https://issues.apache.org/jira/browse/SUREFIRE-1804) fix surefire-shadefire-3.0.0-M5.jar reproducibility issue on other envs

**Issue Links:**
- [MASFRES-34](https://issues.apache.org/jira/browse/MASFRES-34) exclude maven-shade-plugin generated dependency-reduced-pom.xml

Start with the reproducible-central automated rebuild script and its surefire-shared-utils-3.0.0-M5.buildinfo.compare results. Investigate the SUREFIRE-1803 dependency generation and SUREFIRE-1804 shading sub-tasks, with MASFRES-34 as an additional reference. Done means the five listed artifacts reproduce exactly across independent environments.

Written by the indexing model from the issue text.