Also exclude omitted dependencies

[timtebeek]

What's changed?

What's your motivation?

When conflicts occur dependencies are omitted; when we then exclude from the conflict, the omitted dependency can resurface. The goal of ExcludeDependency is to fully exclude a dependency, not to see the omitted conflict being used. We should then also add <exclusion> where dependencies are omitted.

Anything in particular you'd like reviewers to focus on?

Anyone you would like to review specifically?

Have you considered any alternatives or workarounds?

Any additional context

Checklist

• I've added unit tests to cover both positive and negative cases
• I've read and applied the recipe conventions and best practices
• I've used the IntelliJ IDEA auto-formatter on affected files

[timtebeek]

As discussed on
our OSS Slack:

I've not had time to dive in again; what I think is happening here is that we do not mark the log4j-api as a transitive dependency if that's omitted for conflict ; that's technically correct, but when we then exclude the conflicted dependencies elsewhere it will no longer be omitted
for a structural fix we'd ought to exclude the transitive dependency even when omitted due to a conflict, I think

[timtebeek]

• Replaced by Also exclude omitted dependencies #4563