"False positives" in SBOM when building OSGi bundle with maven-bundle-plugin

We recently started to use the **`cyclonedx-maven-plugin`** to create the SBOM of our OSGI components, which are built with the **`maven-bundle-plugin`** (from Apache Felix). We have detected that the created SBOM can contain several false positives due to the following behaviour (taken from the **`maven-bundle-plugin`** documentation):

> Normally the plugin only checks direct dependencies, but this can be changed to include the complete set of transitive dependencies with the following option:
>
> `true`

Let's take this example:


A module has a direct compile scope dependency to **`gcc-restclient`**. This jar will get embedded into the bundle and is also getting listed in the bom. The **`jackson-databind`** transitive dependency will not get embedded due to the default behavior of **`maven-bundle-plugin`** (see above quote). Still the **`cyclonedx-maven-plugin`** also lists **`jackson-databind`** version 2.9.9 as dependency with scope "required".

**`jackson-databind`** in our case is a "provided" scope dependency (deployed and provided in a much higher version than 2.9.9). We set `includeProvidedScope` to `false` in our **`cyclonedx-maven-plugin`** configuration.

Would it be possible to prevent the creation of such false positives in order to have a trustable bom? Could **`cyclonedx-maven-plugin`** check the used Embed-Transitive setting of **`maven-bundle-plugin`** or could you at least add a new option in your configuration to only check direct dependencies?

Start by tracing how the cyclonedx-maven-plugin resolves Maven dependencies for an OSGi bundle, then compare that behavior with the maven-bundle-plugin's Embed-Transitive setting and the includeProvidedScope configuration. Reproduce the gcc-restclient and jackson-databind example, and consider the issue done when non-embedded transitive dependencies no longer appear as required, or when a direct-dependencies option is implemented and verified.

Written by the indexing model from the issue text.