Do not let third party BOM cross-manage other extensions' dependencies

Follows up #3302

E.g. Debezium BOM brings org.reflections:reflections but none our Debezium extensions actually requires it.

There are a couple of other extensions (JBPM and Asterisk) which have nothing to do with Debezium and we let Debezium BOM manage reflections for them.

Ideally, when flattening our BOM, the third-party BOMs should be only taken effective in the scope of extensions where those BOMs are intended to use: Debezium BOM for Debezium extensions, Azure BOM for Azure extensions, etc.

Start by tracing how the project flattens its BOM and applies third-party BOM dependency management to extensions. Check the Debezium, Azure, JBPM, and Asterisk extension dependency scopes, then verify that each third-party BOM affects only its intended extensions and no unrelated dependencies such as org.reflections.

Written by the indexing model from the issue text.