Fix for #408, ensure nested dependency exclusions aren't overrided

[treilhes]

Hi,

This PR try to solve #408, dependencies are present in the flattened POM even when excluded in a nested dependency of a project.

From my understanding the issue comes from

flatten-maven-plugin/src/main/java/org/codehaus/mojo/flatten/FlattenMojo.java

Line 1126 in 75a3989

for (Artifact artifact : project.getArtifacts()) {

project.getArtifacts() returns all project's resolved artifacts which is ok but using those artifacts as dependencies in the CollectRequest transforms those dependencies as if they were direct ones and by doing so removes any exclusions that may have been set in the nested dependency POM.

I think projectDependencies and managedDependencies are sufficient so the whole loop is unnecessary and can be safely removed:

for (Artifact artifact : project.getArtifacts()) {
    collectRequest.addDependency(RepositoryUtils.toDependency(artifact, null));
}

As I'm not familiar with all the ins and outs of this project i'm not 100% sure of my analysis so please take this removal with caution

A unit test has been added demonstrating the case.
Don't hesitate to request changes if needed

[treilhes]

Contrary to my first assumption it is necessary to provide project dependencies to the collect request but using project.getDependencies() allows providing only direct dependencies instead of also providing transitive ones.
By doing so the collect request will handle the transitive exclusions as expected

[treilhes]

Don't merge this PR yet, it causes a regression on maven dependency version resolution.
Issue is under analysis

[treilhes]

A word about the last commit (5b9a7e2)

It is a workaround to the maven issue apache/maven#7682

This issue was already raised (#185) and solved (#307) by @suztomo in a previous version
Moving from a ProjectBuildingRequest to a CollectRequest did reintroduce the issue but it was still hidden because the plugin was using the first processed dependency instead of using the conflict winner.

To ensure test dependencies did not override runtime dependencies this commit removes them from the collected dependencies and relaunch the conflict resolution process.
By doing so, the real winners between runtime only dependencies are used in the flattened pom

[treilhes]

Hello @slawekjaranowski, @slachiewicz,
Copilot suggestions included except one (you can see why in commit message or copilot conversation)
Ready for a new round of build

[treilhes]

Hello @slawekjaranowski, @slachiewicz,
Seems ok, do you have any additional requirements ?