Add support for maven optionality, fixes #314

[knrc]

No description provided.

[hboutemy]

yes, using Maven POM's <dependency><groupId/><artifactId><version/><optional>true</optional></dependency> as the source for CycloneDX component scope="optional" makes sense

IMHO it makes even more sense than the current (#65) use of maven-dependency-analyzer = the bytecode analyzer used by dependency:analyze to detect unused declared dependencies (with known shortcomings)

I think it would be better to have Maven dependency optional value used by default, and let the use of dependency-analyzer just as a compatibility option if someone really prefers

notice that we need to find better name for the plugin property: useMavenOptionality is awful... :)

[hboutemy]

trying to find namings.
We have 2 algorithms to detect CycloneDX component optional scope:

1. current Use maven dependency analyzer to set scope automatically #65 use of maven-dependency-analyzer bytecode analysis "unused but declared": let's call it "detect unused"?
2. Maven pom.xml 's dependency optional boolean: POM dependency optional

I'd say that option 2 should be default
and activating option 1 could be named detectUnusedForOptionalScope set to true?

[knrc]

yes, using Maven POM's <dependency><groupId/><artifactId><version/><optional>true</optional></dependency> as the source for CycloneDX component scope="optional" makes sense

It fits with the maven idea, but more importantly it is what users would reasonably expect it to be.

IMHO it makes even more sense than the current (#65) use of maven-dependency-analyzer = the bytecode analyzer used by dependency:analyze to detect unused declared dependencies (with known shortcomings)

Agreed, it's flaky and I now know it doesn't work for any artifacts that have been relocated. More importantly it doesn't match the maven resolution behaviour.

I think it would be better to have Maven dependency optional value used by default, and let the use of dependency-analyzer just as a compatibility option if someone really prefers

I would be very happy if we chose that, do we need to make that change in a major version update?

notice that we need to find better name for the plugin property: useMavenOptionality is awful... :)

Yes, I know :)

[knrc]

trying to find namings. We have 2 algorithms to detect CycloneDX component optional scope:

1. current Use maven dependency analyzer to set scope automatically #65 use of maven-dependency-analyzer bytecode analysis "unused but declared": let's call it "detect unused"?
2. Maven pom.xml 's dependency optional boolean: POM dependency optional

I'd say that option 2 should be default and activating option 1 could be named detectUnusedForOptionalScope set to true?

Sounds good to me, I'll rework the PR (likely tomorrow) and push it up again.