fix: Add dependencyManagement exclusions to the child exclusions

[coheigea]

I noticed that if I have a child pom with a dependency with some exclusions, and a parent pom with a dependencyManagement section with the same dependency with different exclusions, then Trivy only uses the child exclusions.

This is not the behaviour that the maven command line uses, the mvn dependency:tree combines the set of exclusions in this case.

To reproduce unzip "trivy.zip" attached and run:

 mvn dependency:tree | grep jettison

This will return nothing as jettison is excluded in the parent pom. Now run:

 trivy fs . | grep jettison

and see it returns findings in jettison even though it's not on the classpath

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coheigea]

trivy.zip

[DmitriyLewen]

hello @coheigea
Thanks for your work!

Can you create new test for these changes?

Regards, Dmitriy

[coheigea]

@DmitriyLewen How do I run the tests...even on main, I'm getting failures with:

go test ./pkg/dependency/parser/java/pom

[DmitriyLewen]

use mage - https://aquasecurity.github.io/trivy/v0.52/community/contribute/pr/#unit-tests

[coheigea]

@DmitriyLewen I added a test, but I'm having trouble running the tests locally even with mage, can you enable the workflow please?

[DmitriyLewen]

it should work

➜  cd ./pkg/dependency/parser/java/pom 
➜  go test -run "TestPom_Parse"   
PASS
ok      github.com/aquasecurity/trivy/pkg/dependency/parser/java/pom    0.039s

[coheigea]

Please re-run the tests

[coheigea]

All checks passed 👍

[DmitriyLewen]

@coheigea I changed your test to show that mvn merges exceptions from base pom and parent (your test showed that mvn takes exceptions from parent, but didn't show that exceptions from the base pom are also used).
Can you take a look?

[coheigea]

Yes it's fine thanks! @DmitriyLewen

[DmitriyLewen]

@coheigea Thanks for your work!

LGTM

@knqyf263 take a look, when you have time, please