Fix module deduplication

[TimMoore]

• Classifiers may have values other than "native".
• Artifact.type is a String, not an Option[String].
• Fill in missing tests.

Ref:

• 'Multiple elements for the same key' on sbt 1.3.0 #58
• Discard native variants of modules when merging #59
• Merge modules with the same classifier and type #68
• Lagom master builds fail on whitesource with duplicate artifact  lagom/lagom#2331

[dwijnand]

I'm concerned this is making it overly lax. I'd be happy to add linux-x86_64 as a classifier that gets ignored, but I think it's safer to blow up with a "Multiple elements for the same key" exception than to silently choose to ignore anything with a classifier.

But I'm open to being convinced.

[TimMoore]

The classifier is defined by the artifact. It has no intrinsic meaning. We would potentially have to keep adding exceptions case-by-case.

[TimMoore]

If it does blow up, how else would we handle it, other than by creating a new exception here?

[dwijnand]

Classifiers have meaning, otherwise why would they exist? They come from libraryDependencies. I'm not sure how we'd handle it, but we'd have to think about it.

If we want to add a way (e.g. a callback thingy) to allow downstream builds to handle it, then that would be fine for me.

[dwijnand]

Changed my mind. The metadata must flow. And we'll pick up the pieces if it ends up being a mistake.

[TimMoore]

Thanks, @dwijnand. What I meant by that is that the meaning is ascribed by the author of the library that uses it. The string "native" isn't magic, it's just what the jffi artifact happens to use. And netty-transport-native-epoll happens to use linux-x86_64. Other artifacts could use other strings, they're arbitrary identifiers as far as Maven and sbt are concerned (with the exceptions of tests and sources which are built-in conventions).

It would be better if you could include all classifiers, because indeed these might contain different code, but I assume that would require changes on Whitesource's side to track libraries at that level of granularity.

[dwijnand]

It might cause a problem, but as far as their programmatic API goes you can set the classifier - which is why it's even being touched here.

So we could, if we wanted to, get this plugin out of the business of trying to sanitise the data and handle dedup within Whitesource. But that's not necessary for now.