[MENFORCER-490] Declare maven-enforcer-extension dependencies

[elharo]

MENFORCER-490 is going to take multiple PRs to work through. This starts with a couple of the simpler fixes.

[slawekjaranowski]

As you see at build result - at least plexus-utils is needed in runtime ....

I suppose that can be a bug in exporting artifacts and classes by Maven classloader itself.

[elharo]

I suppose that can be a bug in exporting artifacts and classes by Maven classloader itself.

Yes, it's even more complicated than that. The problem isn't that plexus-utils wasn't added to the classpath. It's that two different copies are loaded by separate classloaders. I think we can declare it provided to get around that.

[cstamas]

This is completely wrong PR: how is plexus-utils provided? It WAS provided in Maven 3.8 and before, but read release notes of Maven 3.9 (same for all 3.9.x version): https://maven.apache.org/docs/3.9.6/release-notes.html#potentially-breaking-core-changes-if-migrating-from-3-8-x

[cstamas]

Stop relying blindly on dependency:analyze output, as it declares many false positives (and negatives), typical example is slf4j-simple etc. Plexus Utils is used but this plugin, hence it must be dependency of it, is definitely not provided!