Utilize base-version instead of version

[ThomGeG]

Ahoy,

I've been integrating this amazing plugin into my stack to get BOMs, however I'd noticed my dependency graph is incomplete due to a subtly in maven's distinction between base-version and version.

The dependency tree of my project looks something like this when doing a mvn dependency:tree:

my-group:my-artifact:war:1.0.0-SNAPSHOT
 +- my-group:another-artifact:pom:1.0.0-SNAPSHOT:compile
 |  \- org.springframework.boot:spring-boot:jar:2.6.7:compile
 \- org.apache.logging.log4j:log4j:jar:2.17.2:compile

While my BOM does contain all those dependencies, the dependency graph does not include spring-boot or another-artifact. I've spent some time tracking down the cause of the issue and found it stems from inconsistent version numbers in the purls being compared here: BaseCycloneDxMojo.java#L898

Where componentRefs contains a purl using a version like 1.0.0-SNAPSHOT for another-artifact, the purl variable it's compared to has 1.0.0-20220314.010735-1. As there's no match in the componentRefs, the dependency is never added and we only get a partial graph.

The reason for the mismatch between version numbers themselves is because when converting a org.apache.maven.artifact.DefaultArtifact to a org.cyclonedx.model.Component we're using DefaultArtifact.getVersion() rather than DefaultArtifact.getBaseVersion(). When the purls were originally created and added to the componentRefs they were created in such a way that they weren't using the timestamped version, and thus the confusion.

Since the changes the fix this seem small I've prepared a PR that gets the two purls back inline with each other.

[stevespringett]

Thanks for the PR