Exclude manifest signatures from third-party deps since it will break shaded jars in some cases