Extraneous licenses.xml entries in plugins with CasC dependency

[daniel-beck]

Jenkins and plugins versions report

Discovered during the release of matrix-auth 3.2.3 which updated the BOM version.

Updating the BOM dependency to 2483.v3b_22f030990a_ or newer added a bunch of bogus license entries in the plugin's about page (target/<artifactid>/META-INF/licenses.xml). I bisected this to #2539.

The following repo contains the pom.xml for a "hello world" plugin in a few "good" and "bad" states:
https://github.com/daniel-beck/bom-2539-casc-1714

In my local testing it wasn't as simple as having the CasC dependency (only), without the test dependencies it didn't happen. So I'm filing this here.

What Operating System are you using (both controller, and any agents involved in the problem)?

n/a

Reproduction steps

See above

Expected Results

Actual Results

Anything else?

No response

Are you interested in contributing a fix?

No response

[daniel-beck]

FTR this still occurs with

        <artifactId>bom-2.452.x</artifactId>
        <version>3532.v8059503f6b_23</version>