fix: problem with gradle version resolution (#141)

## Description

Refactor how the Gradle dependencies are resolved because as the full
tree is available in both component and stack analysis we can use the
right trees instead of just the api / implementation listings. This
helps resolving the correct versions.

With that it is also possible to include the correct scope (required /
optional) to the sbom



**Related issue (if any):** 

- fixes: #138
- fixes: #139
- fixes: #140

Signed-off-by: Chao Wang <chaowan@redhat.com>

Author: soul2zimate

license-header

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2023 Red Hat, Inc.
+ * Copyright © $YEAR Red Hat, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/com/redhat/exhort/providers/AnalysisType.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright © 2023 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.redhat.exhort.providers;
+
+public enum AnalysisType {
+  STACK,
+  COMPONENT
+}

src/main/java/com/redhat/exhort/providers/BaseJavaProvider.java

@@ -32,7 +32,7 @@ protected BaseJavaProvider(Ecosystem.Type ecosystem, Path manifest) {
     super(ecosystem, manifest);
   }
 
-  void parseDependencyTree(String src, int srcDepth, String[] lines, Sbom sbom) {
+  void parseDependencyTree(String src, int srcDepth, String[] lines, Sbom sbom, String scope) {
     if (lines.length == 0) {
       return;
     }
@@ -47,11 +47,12 @@ void parseDependencyTree(String src, int srcDepth, String[] lines, Sbom sbom) {
         PackageURL from = parseDep(src);
         PackageURL to = parseDep(target);
         if (dependencyIsNotTestScope(from) && dependencyIsNotTestScope(to)) {
-          sbom.addDependency(from, to);
+          sbom.addDependency(from, to, scope);
         }
       } else {
         String[] modifiedLines = Arrays.copyOfRange(lines, index, lines.length);
-        parseDependencyTree(lines[index - 1], getDepth(lines[index - 1]), modifiedLines, sbom);
+        parseDependencyTree(
+            lines[index - 1], getDepth(lines[index - 1]), modifiedLines, sbom, scope);
       }
       if (index < lines.length - 1) {
         target = lines[++index];

src/main/java/com/redhat/exhort/providers/GoModulesProvider.java

@@ -300,7 +300,7 @@ private Sbom buildSbomFromGraph(
               dep -> {
                 PackageURL targetPurl =
                     toPurl((String) dep, "@", this.goEnvironmentVariableForPurl);
-                sbom.addDependency(source, targetPurl);
+                sbom.addDependency(source, targetPurl, null);
               });
         });
     List<String> ignoredDepsPurl =
@@ -433,7 +433,7 @@ private Sbom buildSbomFromList(String golangDeps, List<PackageURL> ignoredDeps)
         dep -> {
           PackageURL targetPurl = toPurl(dep, "@", this.goEnvironmentVariableForPurl);
           if (dependencyNotToBeIgnored(ignoredDeps, targetPurl)) {
-            sbom.addDependency(root, targetPurl);
+            sbom.addDependency(root, targetPurl, null);
           }
         });
     List<String> ignoredDepsByName = new ArrayList<>();