"Adal4j" library is not optional in 21.0.0.-legacy release

[Babak-abd]

Describe the bug
On #3175 PR, Adal was marked as Optional but when i am looking at 21.0.0-legacy on mvn repository, it does not show it as optional.
I am sure that at one point, I saw it optional and our security scans did not report this.

now with this version, our scans are showing CVE-2021-31684 and CVE-2023-1370 which is related to nimbus-jose-jwt-9.8.1.jar and json-smart-2.4.2.jar libraries.
Client Version
21.0.0.-legacy

[Babak-abd]

not sure if its related but should https://github.com/kubernetes-client/java/blob/release-legacy-21/util/pom.xml#L62 be also optional?

[brendandburns]

I think we need to backport #3560 into the legacy branch.

The basic bug is that mvn appears to not respect inheritance of optional in child poms.

[kevinh-hcl]

thank you for backporting this. is there any date scheduled for the 21.0.1 legacy version to be built with those changes?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale