Mark Maven-exported dependencies as scope provided

[kwin]

To prevent unnecessary artifact downloads with Maven 3 all dependencies provided by the Maven distribution should have scope "provided" (and only be listed with the version shipping with the minimum Maven version being supported). For further info look at https://issues.apache.org/jira/browse/MPLUGIN-370 and https://issues.apache.org/jira/browse/MNG-7097.

[hazendaz]

Overall this won't really help much with maven 3 given all plugins would need to do this for it to really matter. I had this done a couple weeks back but didn't send PR until after you reminded me :) Maven plugin plugin 3.6.2 now echos what to make provided. PR #388

[kwin]

all plugins would need to do this for it to really matter.

I disagree, because plugins have different versions of Maven-exported dependencies referenced. I was forced to download 3.8.4 of a lot of Maven artifacts unnecessarily only because of spotbugs-maven-plugin although I regularly build large Maven projects on a regular basis (no other Maven plugin I use depends on Maven 3.8.4 given that this distro is only a few weeks old)

[hazendaz]

ok but you have downloaded many other maven components. Even maven hasn't made this change entirely yet. They just started doing so a few weeks ago. I follow them pretty tightly. I'm just pointing out the obvious. Most, if not all, maven plugins pull maven core versions and it will take a long time for all plugins to become compliant and some may not due to little support. Look in your .m2 cache. I suspect you retain a cache, this is more obvious on cacheless CI builds like github actions. This was a maven 4 backport item, that is all I was referring to, locally, builds will still end up with lots of different versions depending on what the plugin was built against. This one just happens to release very frequently and always will be on latest maven. As such, I had this change done 13 days prior to the issue being raised but had not merged it in yet as I won't release until I need to which will be probably less than a month from now.

[hazendaz]

done in #388