Use java.net.http.HttpClient instead of java.net.Http(s)URLConnection (#217)

Moving to java.net.http.HttpClient brings many benefits, including
HTTP/2 support and the ability to make asynchronous requests.

Major additions and changes:
- Introduce a lightweight org.pkl.core.http.HttpClient API.
  This keeps some flexibility and allows to enforce behavior
  such as setting the User-Agent header.
- Provide an implementation that delegates to java.net.http.HttpClient.
- Use HttpClient for all HTTP(s) requests across the codebase.
  This required adding an HttpClient parameter to constructors and
  factory methods of multiple classes, some of which are public APIs.
- Manage CA certificates per HTTP client instead of per JVM.
  This makes it unnecessary to set JVM-wide system/security properties
  and default SSLSocketFactory's.
- Add executor v2 options to the executor SPI
- Add pkl-certs as a new artifact, and remove certs from pkl-commons-cli artifact

Each HTTP client maintains its own connection pool and SSLContext.
For efficiency reasons, It's best to reuse clients whenever feasible.
To avoid memory leaks, clients are not stored in static fields.

HTTP clients are expensive to create. For this reason,
EvaluatorBuilder defaults to a "lazy" client that creates the underlying
java.net.http.HttpClient on the first send (which may never happen).

pkl-commons-test/src/main/kotlin/org/pkl/commons/test/FakeHttpResponse.kt

@@ -0,0 +1,58 @@
+/**
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.commons.test
+
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpHeaders
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.util.*
+import javax.net.ssl.SSLSession
+
+class FakeHttpResponse<T : Any> : HttpResponse<T> {
+  companion object {
+    fun <T : Any> withBody(block: FakeHttpResponse<T>.() -> Unit): FakeHttpResponse<T> =
+      FakeHttpResponse<T>().apply(block)
+
+    fun withoutBody(block: FakeHttpResponse<Unit>.() -> Unit): FakeHttpResponse<Unit> =
+      FakeHttpResponse<Unit>().apply { body = Unit }.apply(block)
+  }
+
+  var statusCode: Int = 200
+  var request: HttpRequest = HttpRequest.newBuilder().uri(URI("https://example.com")).build()
+  var uri: URI = URI("https://example.com")
+  var version: HttpClient.Version = HttpClient.Version.HTTP_2
+
+  lateinit var headers: HttpHeaders
+  lateinit var body: T
+
+  override fun statusCode(): Int = statusCode
+
+  override fun request(): HttpRequest = request
+
+  override fun previousResponse(): Optional<HttpResponse<T>> = Optional.empty()
+
+  override fun headers(): HttpHeaders = headers
+
+  override fun body(): T = body
+
+  override fun sslSession(): Optional<SSLSession> = Optional.empty()
+
+  override fun uri(): URI = uri
+
+  override fun version(): HttpClient.Version = version
+}

pkl-commons-test/src/main/kotlin/org/pkl/commons/test/FileTestUtils.kt

@@ -16,8 +16,8 @@
 package org.pkl.commons.test
 
 import java.nio.file.Path
+import java.util.stream.Collectors
 import kotlin.io.path.*
-import kotlin.streams.toList
 import org.assertj.core.api.Assertions.fail
 import org.pkl.commons.*
 
@@ -32,10 +32,23 @@ object FileTestUtils {
   val selfSignedCertificate: Path by lazy {
     rootProjectDir.resolve("pkl-commons-test/build/keystore/localhost.pem")
   }
+
+  fun writeCertificateWithMissingLines(dir: Path): Path {
+    val lines = selfSignedCertificate.readLines()
+    // drop some lines in the middle
+    return dir.resolve("invalidCerts.pem").writeLines(lines.take(5) + lines.takeLast(5))
+  }
+
+  fun writePklBuiltInCertificates(dir: Path): Path {
+    val text = javaClass.getResource("/org/pkl/certs/PklCARoots.pem")!!.readText()
+    return dir.resolve("PklCARoots.pem").apply { writeText(text) }
+  }
 }
 
 fun Path.listFilesRecursively(): List<Path> =
-  walk(99).use { paths -> paths.filter { it.isRegularFile() || it.isSymbolicLink() }.toList() }
+  walk(99).use { paths ->
+    paths.filter { it.isRegularFile() || it.isSymbolicLink() }.collect(Collectors.toList())
+  }
 
 data class SnippetOutcome(val expectedOutFile: Path, val actual: String, val success: Boolean) {
   private val expectedErrFile =

pkl-commons-test/src/main/kotlin/org/pkl/commons/test/FilteringClassLoader.kt

@@ -0,0 +1,29 @@
+/**
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.commons.test
+
+class FilteringClassLoader(parent: ClassLoader, private val includeFilter: (String) -> Boolean) :
+  ClassLoader(parent) {
+
+  init {
+    registerAsParallelCapable()
+  }
+
+  override fun loadClass(name: String, resolve: Boolean): Class<*> {
+    if (!includeFilter(name)) throw ClassNotFoundException(name)
+    return super.loadClass(name, resolve)
+  }
+}