[MENFORCER-432] requireUpperBoundDeps support for checking dependencyManagement

**[Marcono1234](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=marcono1234)** opened **[MENFORCER-432](https://issues.apache.org/jira/browse/MENFORCER-432?redirect=false)** and commented

For projects which are either used as parent by other projects, or which are used as Bill of Materials (BOM) and which declare dependencies in the `dependencyManagement` it would be useful if `requireUpperBoundDeps` was able to check the dependencies in the `dependencyManagement`. This would allow verifying that the versions of these managed dependencies are correct and do not cause any issues for consuming projects.

Currently `requireUpperBoundDeps` seems to only check regular dependencies; this prevents it from being used directly on the parent / BOM project, but requires applying it on all consuming projects.
It would be quite useful to already detect conflicting dependency versions directly in the parent / BOM project.

Maybe a separate option for this (e.g. `checkDependencyManagement`) would be useful to allow enabling / disabling this check.

It appears maven-dependency-tree already determines those managed dependencies in `DefaultDependencyCollectorBuilder` respectively `Maven31DependencyCollectorBuilder` (in older versions), but does not expose this information.

### Example

```xml

4.0.0

com.example
my-bom
1
pom

org.slf4j
slf4j-api
1.4.0


ch.qos.logback
logback-classic
0.9.9

org.apache.maven.plugins
maven-enforcer-plugin
3.2.1


enforce







enforce

```

Running `mvn validate` passes. Only when changing the `dependencyManagement` to regular dependencies Maven Enforcer detects the rule violation.

---

**Affects:** 3.1.0, 3.2.1

Start with the requireUpperBoundDeps rule and inspect how maven-dependency-tree determines managed dependencies in DefaultDependencyCollectorBuilder and the older Maven31DependencyCollectorBuilder. Use the provided BOM example as a reproduction and verify that dependencyManagement conflicts are detected, with a way to enable or disable the check if that design is retained.

Written by the indexing model from the issue text.