Maven plugin dependencies are not recorded

[I-Al-Istannen]

Hey,

since the newest version plugin hashes are included in the lockfile, but their dependencies are missing.

[MartinWitt]

After a first look, we can almost assume a plugin is a dev dependency, an artifact. I am sure we can get the tree for it, but adding the reduced dependency tree looks complex.

[I-Al-Istannen]

It doesn't necessarily have to be reduced, as long as it contains the used version(s).

[adambkaplan]

Encountered this issue when doing a PoC integration of this plugin's lockfile with Hermeto - a tool for pre-fetching dependencies into a hermetic build environment.

In order to execute a build with no network access, we need a lockfile that includes the maven plugin dependency tree.

[monperrus]

@LogFlames could you handle this? Thanks!