Wrong classpath with Gradle `compileOnly` like instructions

We need to use the compileOnly in a gradle modules.
The expected behaviour is to have the dependency available at the compile time, but not at runtimes.

It's useful to create spring boot auto-configurations that load only if the dependency is present in the consumer module.

We have this declaration in a library:

dependencies {
  compileOnly 'org.springframework.boot:spring-boot-starter-security'
}

In the application module we have this declaration:

dependencies {
  implementation project(':libs:my-lib')
}

Running the following command, the project works as expected. The spring-boot-starter-security is not loaded.

./gradlew bootRun

But if we run the following configuration, the dependency is in classpath at runtime and the auto-configuration is applied at wrong.

{
  "configurations": [
    {
      "type": "java",
      "name": "Spring Boot-Application",
      "request": "launch",
      "cwd": "${workspaceFolder}",
      "mainClass": "com.mycompany.Application",
      "projectName": "application",
      "args": ""
    }
  ]
}

There is also dependency problems in test but I can't exactly explain what. There is some BeanDefinitionOverrideException that are not present running the ./gradlew test command.

Reproduce the project with the shown compileOnly dependency, comparing ./gradlew bootRun and the Java launch configuration in .vscode/launch.json. Trace the classpath assembled for the VS Code launch and test runs; done means compileOnly dependencies stay available for compilation but are absent at runtime, matching Gradle behavior.