[MNGSITE-367] Document how versions of a direct dependency's transitive dependencies are selected.

**[Elliotte Rusty Harold](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=elharo)** opened **[MNGSITE-367](https://issues.apache.org/jira/browse/MNGSITE-367?redirect=false)** and commented

Situation:

a:a depends on foo:foo:2.1
foo:foo:2.1 depends on baz:baz:3.2
baz:baz:3.2 depends on guava:guava:25.0-android

However, foo:foo:2.1 imports a BOM (or inherits from a parent pom) that specifies that guava:guava:27.1-jre will be used.

So which version of guava:guava does a:a add to its classpath, 25.0-android or 27.1-jre? I think the answer is 25.0-android. That is, the dependency management from the middle of the tree is ignored when building a:a.

However I don't think the docs ever say this. They need to.

---
No further details from [MNGSITE-367](https://issues.apache.org/jira/browse/MNGSITE-367?redirect=false)

Locate the Maven documentation section covering dependency mediation and dependency management, then compare it with the a:a → foo:foo → baz:baz scenario in the issue. Done means the documentation clearly explains how the transitive dependency version is selected when an intermediate dependency imports a BOM or inherits from a parent POM.

Written by the indexing model from the issue text.