inject artificial dependencies (conditional on existing ones)

**Is your feature request related to a problem? Please describe.**

I discovered… things… during a licence review of our project’s dependencies. For example, byte-buddy and Lombok both contain embedded code copies of ASM. Spring also does, but its is contained in its sources, but it also contains embedded code copies (shaded at compile time) of cglib and objenesis. It’s not impossible to discover the precise versions used.

I’m pretty sure that these recursive dependencies`^W^W`embedded code copies are not scanned correctly.

**Describe the solution you'd like**

I would like to have it possible to declare to-be-injected dependencies. I’m already using this in my “create a PKZIP archive containing *all* `sources.jar`s of *all* dependencies, recursively” script, which has an additional input file (backslash+newline and comment lines ignored), in which Maven _groupId:artifactId:version_ vectors are listed, the first one is the “trigger”, the other ones on the line are the ones to be added. For example:

~/Misc/Vendor/VerA.web $ cat release/ckdep.ins
# shaded into byte-buddy
net.bytebuddy:byte-buddy:1.10.3 \
org.ow2.asm:asm:7.2 \
org.ow2.asm:asm-commons:7.2

This line makes it add `asm` and `asm-commons` 7.2 **and** their recursive dependencies `asm-analysis` and `asm-tree` to the list of sources to pull.

This could also be useful for the OWASP dependency check plugin. I’d most likely add Spring’s ASM copy to it, as to catch security issues in it more easily.

**Describe alternatives you've considered**

I’ve looked at (generating from the list above) dependency-hint XML files but don’t think they are powerful enough to express “when artifact foo.bar:baz:1.2 exists, add bla.meow:foo:3.4 to the list of dependencies present in the project”.