`Boruta.Cache` is started even when another `cache_backend` is configured

Start at Boruta.Application.start/2 in lib/boruta/application.ex and inspect how Boruta.Config.cache_backend() selects the cache. Verify the application restart behavior with the new backend configuration, then update the Boruta.Config moduledoc and CHANGELOG as described; done means the configured alternative backend does not start Boruta.Cache while the default still does.

What is wrong

Boruta.Application.start/2 always starts Boruta.Cache (lib/boruta/application.ex on v2-3, unchanged on master):

children = [
  Boruta.Cache,
  {Finch, name: OpenIDHttpClient}
]

The cache_backend option exists so that a host application can bring its own backend, and the library honours it everywhere it caches: Boruta.Ecto.ClientStore, Boruta.Ecto.ScopeStore and Boruta.Ecto.TokenStore only ever call Boruta.Config.cache_backend(), and nothing else references Boruta.Cache. With another backend configured the Nebulex cache is therefore started, supervised and replicated for no caller.

What it costs

Boruta.Cache is a Nebulex.Adapters.Replicated cache. Started with a no-op cache_backend configured (Boruta 2.3.8, Nebulex 3.0.4, nebulex_distributed 3.2.3, OTP 29), its tree looks like this:

Small in absolute terms, but on connected nodes the cluster monitor also joins the pg group and pushes a bootstrap of the (empty) cache to its peers on every start, and the host carries the nebulex, nebulex_local, nebulex_distributed, nebulex_streams, shards, ex_hash_ring and partitioned_buffer packages in its release for code it never calls.

Proposed fix (PR follows)

Start Boruta.Cache only when Boruta.Config.cache_backend() is Boruta.Cache. A host with another backend already has to start that backend itself, so nothing changes for it, and nothing changes for the default configuration. The PR adds the conditional in Boruta.Application, a sentence in the Boruta.Config moduledoc, a test that restarts the application with another backend, and a CHANGELOG entry. The patch applies unchanged to master.

Making nebulex an optional dependency, so that hosts with their own backend do not ship it at all, would be the next step; Boruta.Cache is defined with use Nebulex.Cache at compile time, so that is a separate change.