Run forbidden APIs checks in a forked JVM so we can run it for any version

[alpar-t]

The forbidden APIs precommit check runs with the same Java version as Gradle, creating tight coupling between our build JDK and runtime JVM setting. We would like to run this check forked, so we can run it with the runtime JVM regardless of what's being used to build the project.
Since we already require env vars for the Java home of different versions, we could also run it for multiple java versions if so desired.

[elasticmachine]

Pinging @elastic/es-core-infra

[alpar-t]

These checks are implemented in https://github.com/policeman-tools/forbidden-apis, including the Gradle plugin, which does not currently support setting and external JDK ( like JavaCompile does ).

After looking at how Gradle implements JavaCompile for a bit, adding support for such a feature is not trivial. It also got me wondering why it's needed in the first place, @rjernst.
Running with a newer jre should allow us to inspect older versions of the byte-code, so why does it matter ?

It does matter when we have rules for JDK methods such as java.lang.Thread#stop(java.lang.Throwable) which was removed in Java 11, but only because the rule engine can't resolve the method. That could be addressed by failOnMissingClasses, and getFailOnUnresolvableSignatures but that doesn't buy us much, since the code would not compile on newer JDK version, so we would detect it anyhow.

I'm not sure what would happen if a third party jar would use such a removed method ? Would it fail at runtime ? But we wouldn't detect such usage anyhow since we don't inspect the bytecode of everything on the classppath, just the class files of the project.

[alpar-t]

We do have a separate check for third party dependencies, and we do need to check with specific java versions due to multi release jars.