feat(guided remediation): remediate unresolved dependency management vulns

[michaelkedar]

Adds functionality to allow guided remediation to fix vulns in dependencyManagement dependencies that do not appear in the resolved dependency graph of the POM - useful for 'remediating' POMs without any actual dependencies.

I've accomplished this by checking if each of the original management dependencies (excluding those inherited from parents) appear in the graph after the initial resolution. If they're missing, I add them to the graph as direct dependencies (not resolving their transitive dependencies).

This behaviour is disabled by default, and I've added a --maven-fix-management flag to enable it. I was going to try combine this and --ignore-dev into a --groups flag but it seemed like it would be a bit too complicated.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 69.31818% with 27 lines in your changes missing coverage. Please review.

Project coverage is 67.89%. Comparing base (981b0b5) to head (ac05030).
Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/resolution/resolve.go	75.00%	13 Missing and 5 partials ⚠️
scripts/generate_mock_resolution_universe/main.go	0.00%	5 Missing ⚠️
cmd/osv-scanner/fix/model.go	0.00%	3 Missing ⚠️
cmd/osv-scanner/fix/state-relock-result.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    google/osv-scanner#1235      +/-   ##
==========================================
+ Coverage   67.81%   67.89%   +0.08%     
==========================================
  Files         174      174              
  Lines       16769    16831      +62     
==========================================
+ Hits        11372    11428      +56     
- Misses       4767     4768       +1     
- Partials      630      635       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.