[C++] Maintain bundled dependency tarballs in an Apache-managed location

[asfimport]

The CMake scripts for the Arrow C++ library download bundled third-party dependencies from https://github.com/ursa-labs/thirdparty/releases/. Consider maintaining these in an ASF-managed location (probably http://apache.jfrog.io) instead of an Ursa Labs / Voltron Data-managed location. This would make it possible for Arrow committers / PMC members outside of Ursa / Voltron to upload new versions of these dependency tarballs (like in ARROW-14229).

Reporter: Ian Cook / @ianmcook
Assignee: Krisztian Szucs / @kszucs

Related issues:

• [C++] Consolidate thirdparty bundle URLs, version bumping logic, etc (is related to)

_{Note: This issue was originally created as ARROW-14336. Please see the migration documentation for further details.}

[asfimport]

Krisztian Szucs / @kszucs:
Uploaded the dependencies manually to artifactory https://apache.jfrog.io/ui/native/arrow/thirdparty

[asfimport]

Krisztian Szucs / @kszucs:
@kou @ianmcook are there any licensing implications we need to pay attention to?

[asfimport]

Kouhei Sutou / @kou:
We can redistribute unmodified source archives for all open source software without any licensing issue.

BTW: We will be able to use curl to upload source archives like the following:

curl --request PUT --header "X-JFrog-Art-Api: ${API_KEY}" --data-binary @XXX.tar.gz https://apache.jfrog.io/artifactory/arrow/thirdparty/XXX.tar.gz

[asfimport]

Kouhei Sutou / @kou:
ARROW-15372 also implemented this.