ci: validate distribution zip contains LICENSE and NOTICE

[hemasrishalini]

Summary

Adds a Gradle validation task that opens distribution archives and
checks that LICENSE and NOTICE files are present inside them.

Changes

• Add validateDistributionLicenseNotice Gradle task
• Opens ZIP and TAR archives and reads their contents
• Fails the build if LICENSE or NOTICE is missing inside either archive
• Wired into Gradle check lifecycle so CI catches this automatically

Testing

Ran locally:
./gradlew :polaris-distribution:check
Output: "LICENSE and NOTICE validated successfully in both ZIP and TAR archives."

Closes #4186

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Fixes # 4186
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[snazy]

I do not think this validation adds coverage.

The LICENSE/NOTICE files are produced by licenseNoticeMerge, which consumes the licenseNoticeElements configurations from polaris-admin and polaris-server.

LicenseNoticeMerge unconditionally reads both LICENSE and NOTICE from each input directory, so a missing file already fails the distribution build.

This task also only validates presence by archive entry name; it does not cover the content/staleness checks requested in #4186.

The existing admin/server checks already validate mentioned dependencies.

So this change seems redundant.

[hemasrishalini]

I investigated the existing validation and packaging flow further.

From what I found:

• LicenseNoticeMerge already fails if LICENSE/NOTICE inputs are missing.
• LicenseFileValidation already validates missing and superfluous dependency license mentions.
• The distribution packaging also uses the merged output directly via from(licenseNoticeMerge).

So I understand now that my current archive presence validation overlaps significantly with the existing implementation.

If there is still a specific validation scenario from #4186 that is not currently covered, I’d be happy to continue working on that direction.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.