Support dev dependencies in pom.xml

[metametadata]

Description

Vuln scanning of pom.xml should be able to scan dev dependencies too.

E.g. --include-dev-deps existing flag can be used to specify such behaviour.

Currently it's stated in https://aquasecurity.github.io/trivy/v0.54/docs/coverage/language/java/ that pom.xml dev deps will be excluded.

Target

Filesystem

Scanner

Vulnerability

[knqyf263]

Do you mean <scope>test</scope> should be included with --include-dev-deps?

[metametadata]

Yes.

[knqyf263]

It makes sense to me.
@DmitriyLewen What do you think? If it sounds reasonable to you, please convert it into an issue.

[DmitriyLewen]

yeah. It is good idea.

[DmitriyLewen]

Created #7384