Check Yarn vulnerabilities with aggregate goal of maven plugin

I tried to integrate `dependency-check-maven` to my multi-module maven project, all works as expected when using for java.

But in my project I'm using [`frontend-maven-plugin`](https://github.com/eirslett/frontend-maven-plugin) to build a frontend webapp with **yarn**.

There is 2 web application in webapp folder of 2 child module (`leshan-server-demo` / `leshan-bsserver-demo`) .
Yarn is downloaded by this `frontend-maven-plugin`.
So I adapted my pom like this :
```xml

org.owasp
dependency-check-maven



${project.basedir}/webapp

package.json
yarn.lock



${project.basedir}/webapp/node/yarn/dist/bin/yarn


```
See commit : https://github.com/eclipse-leshan/leshan/commit/c611bcfa852e330af13a3cc27bbb14b83fde253e

This works when I use `mvn dependency-check:check` (I mean I see js vulnerabilities).
But this doesn't work when using `mvn dependency-check:aggregate`. (in that case I just see java vulnerabilities)

(I know that documentation says to not use ${project.basedir} but I was not able to make it works without this.

I succeed to workaround this by adding this configuration on root pom.xml :
```xml

aggregate



org.owasp
dependency-check-maven



${project.basedir}/leshan-server-demo/webapp

package.json
yarn.lock



${project.basedir}/leshan-bsserver-demo/webapp

package.json
yarn.lock



${project.basedir}/leshan-server-demo/webapp/node/yarn/dist/bin/yarn

```
(commit https://github.com/eclipse-leshan/leshan/commit/4e247194c90ce97de8ce314ca36a49b48323cc73)
And now it works when using : `mvn -Paggregate dependency-check:aggregate`
But the solution is clearly not elegant and so I guess I missed something :thinking:

Please let me know, if I did something wrong ? :pray:

If you want to reproduce :
```sh
# Get owasp branch in official leshan repository
git clone -b owasp git@github.com:eclipse-leshan/leshan.git leshan-owasp
cd leshan-owasp
# build the project without tests. (this will download node/yarn)
mvn clean install -DskipTests
# See result with and without workaround (aggregate profile)
mvn dependency-check:aggregate
mvn -Paggregate dependency-check:aggregate
```