Consider test for shaded Uberjar

The SBOM at https://repo1.maven.org/maven2/org/apache/hadoop/hadoop-common/3.3.6/hadoop-common-3.3.6-cyclonedx.xml is incorrectly reporting Apache-2.0 license for the BSD-licensed Google's protobuf that is shaded and available separately.

The POM at https://repo1.maven.org/maven2/org/apache/hadoop/hadoop-common/3.3.6/hadoop-common-3.3.6.pom seems correct otherwise

The parent POM chain of this shaded protobuf POM also has an incorrect Apache license.... but the JAR itself contains a correct license inside.
See https://repo1.maven.org/maven2/org/apache/hadoop/thirdparty/hadoop-shaded-protobuf_3_7/1.1.1/hadoop-shaded-protobuf_3_7-1.1.1.pom

This is a nice example of a parent POM for a shaded mini Uber-JAR with rewritten bytecode and altered classpath that we should be able to match to the original at https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.7.0/ and therefore a useful test case.

Beside matching, this would be an interesting case of how we can handle a curation for these in the purldb.