fix: GH-7566 resolve overridden plugin dependencies correctly

Author: bjansen

maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java

@@ -34,6 +34,7 @@
 import org.apache.maven.doxia.sink.Sink;
 import org.apache.maven.execution.MavenSession;
 import org.apache.maven.model.License;
+import org.apache.maven.model.Plugin;
 import org.apache.maven.plugin.AbstractMojo;
 import org.apache.maven.plugin.MojoExecution;
 import org.apache.maven.plugin.MojoExecutionException;
@@ -98,6 +99,7 @@
 import org.owasp.dependencycheck.xml.pom.Model;
 import org.owasp.dependencycheck.xml.pom.PomUtils;
 
+import javax.inject.Inject;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
@@ -1546,6 +1548,22 @@ protected Set<Artifact> resolveArtifactDependencies(final org.eclipse.aether.art
         collectRequest.setRoot(new org.eclipse.aether.graph.Dependency(rootArtifact, null));
         collectRequest.setRepositories(project.getRemoteProjectRepositories());
 
+		final Plugin projectPlugin = project.getPlugin(rootArtifact.getGroupId() + ":" + rootArtifact.getArtifactId());
+        
+        if (projectPlugin != null) {
+            for (org.apache.maven.model.Dependency dep : projectPlugin.getDependencies()) {
+                final org.eclipse.aether.graph.Dependency aetherDep = new org.eclipse.aether.graph.Dependency(
+                        new org.eclipse.aether.artifact.DefaultArtifact(
+                                dep.getGroupId(),
+                                dep.getArtifactId(),
+                                null,
+                                "jar",
+                                dep.getVersion()),
+                        dep.getScope());
+                collectRequest.addDependency(aetherDep);
+            }
+        }
+        
         final DependencyResult dependencyResult = repoSystem.resolveDependencies(
                 session.getRepositorySession(), new DependencyRequest(collectRequest, null));