Emit the project's effective apache-rat excludes as a .rat-excludes file at upload time

### Context

When verifying release candidates via ATR, the RAT check runs its own `apache-rat 0.18` with the standard exclude sets but has no knowledge of a project's `apache-rat-plugin` configuration. Files a project deliberately excludes therefore surface as "unknown license" false positives — e.g. on the Maven Resolver Ant Tasks 1.6.1 RC, `src/test/resources/ProjectWorkspaceReader/dummy-file.txt` and `.../ant/Resolve/dependencies.txt` (both covered by the project's `src/test/resources/**/*.txt` exclude; the project's own `apache-rat:check` is green with 0 unknown).

Discussed on dev@tooling: https://lists.apache.org/thread/1ks8dbdxr2smhf5y0odmoybwvg0dbrq8 — Dave Fisher suggested splitting this into two issues (this one + a companion in `tooling-trusted-releases`).

### Proposal

Since `atr:upload` already runs *inside* Maven, it has the effective project model — and thus the effective RAT excludes — available. During upload it could serialize those excludes into a well-known `.rat-excludes` file and upload it alongside the artifacts.

### Notes

* Source of truth: the `apache-rat-plugin` configuration in the effective model (maven-parent defaults + the project's own `` / ``), so profiles and inheritance are resolved correctly — which is exactly what an external pom.xml parse could not do reliably.
* The companion issue (`tooling-trusted-releases`) covers ATR consuming this file (`--input-exclude-file`). Projects that don't upload via the plugin keep today's behaviour.
* Related: apache/tooling-trusted-releases#312 (same idea for the non-RAT licence check), apache/tooling-trusted-releases#1426 (check-result UX).

Start at the atr:upload entry point and trace how the effective Maven project model is available during upload. Review how apache-rat-plugin excludes, excludesFile, profiles, and inherited defaults are represented, then determine how the effective excludes should be serialized and uploaded as .rat-excludes alongside the artifacts. Done means the generated file reflects the effective project configuration.

Written by the indexing model from the issue text.