[MNG-7757] Resolved dependencies are not taking into account dependency management

**[Daniel Puiu](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=JIRAUSER285001)** opened **[MNG-7757](https://issues.apache.org/jira/browse/MNG-7757?redirect=false)** and commented

I have the following case:
* Project C depends on project D (compile scope).
* Project B depends on project C (compile scope) and declares project D in dependency management as provided.
* Project A depends on project B (compile scope).

Running dependency:tree on A outputs:

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ test-maven-dependency-tree-bug-A ---
[INFO] org.example:test-maven-dependency-tree-bug-A:jar:1.0-SNAPSHOT
[INFO] \- org.example:test-maven-dependency-tree-bug-B:jar:1.0-SNAPSHOT:compile
[INFO]    \- org.example:test-maven-dependency-tree-bug-C:jar:1.0-SNAPSHOT:compile
[INFO]       \- org.example:test-maven-dependency-tree-bug-D:jar:1.0-SNAPSHOT:compile
```

Also, building a fat jar with maven-assembly-plugin adds the content of D to the jar.

Both plugins use org.apache.maven.DefaultProjectDependencyGraph (which is marked as internal and deprecated) to resolve the dependency tree. This is actually the reason for which I am opening the ticket on maven's side and not on maven-dependency-plugin and maven-assembly-plugin sides.

From the [documentation](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html), my understanding is that D should appear as provided in the dependency tree and not be part of the fat jar created by assembly plugin.

I have tested both plugins mainly with maven 3.8.5, but have obtained the same results with 4.0.0-alpha5, 3.6.3 and 3.0.5

I have attached a multi module project on which I tested the case.

---

**Attachments:**
- [test-maven-dependency-tree-bug.7z](https://issues.apache.org/jira/secure/attachment/13057138/test-maven-dependency-tree-bug.7z) (_6.00 kB_)