Fix inverted exclusion comparison in RemoveRedundantDependencies (#191)

* Ignore spurious transitive exclusions when detecting redundant dependencies

A dependency's effective exclusions are resolved within the matched parent's
whole tree, so they can be polluted by exclusions other branches declare
against artifacts the coordinate could never bring on its own (e.g. an optional
dependency pruned elsewhere). Comparing these raw sets against a clean direct
declaration made the recipe keep genuinely redundant dependencies.

Filter each transitive's effective exclusions down to artifacts in the
coordinate's own dependency closure, dropping no-op exclusions before the
comparison. This only ever drops exclusions that change nothing, so it never
causes an unsafe removal.

* Simplify redundant-dependency exclusion filtering

Share the POM download/resolve path between resolveTransitivesFromPom and
dependencyClosure via resolvePom/withMavenCentral helpers, and hoist the
closure cache onto the Accumulator so it survives across source files in a
multi-module build.

* Compare declared exclusions, not effective ones, for redundant dependencies

Within a large dependency tree a coordinate's effective exclusions are corrupted
by dependency mediation: an artifact excluded on one path may already have been
pruned at a shared node, so it silently drops out of getEffectiveExclusions().
That inverted RemoveRedundantDependencies for e.g. spring-boot-starter-web ->
spring-boot-starter-tomcat -> tomcat-embed-websocket (openrewrite/rewrite#8336).

Compare each coordinate's declared (requested) exclusions instead, intersected
with its own clean closure to drop no-op exclusions, and apply the same relevant
-exclusion logic to the direct declaration being evaluated for removal.

Fixes openrewrite/rewrite#8336

* Resolve dependency closures lazily when comparing exclusions

Closure resolution was eager: every visited node carrying an inherited
exclusion triggered a POM download, resolve and compile-scope graph
resolution. Since ancestor exclusions are propagated into each child's
requested dependency, the "no exclusions" early-out rarely fired, so a
spring-boot-starter tree performed ~38 extra resolutions of which one was
ever consulted.

TransitiveDependency now carries declared exclusions, and the closure
intersection is deferred into isRedundant, where it runs only for a
coordinate that actually matched and only when the two declared sets
differ. Both sides share a single closure for that coordinate.

Also collapse the (repositories, downloader, ctx, cache) tuple into a
ClosureResolver, dedupe the two recursive dependency walks, key the cache
on GroupArtifactVersion so it is not repository-sensitive, and correct
the description and comments that described the abandoned mechanism.

* Drop redundant null check on non-null getRequested()

* Name the closure cache for what it holds

* Regenerate recipes.csv

* Keep dependencies whose declared exclusions differ

Comparing declared exclusions still required resolving each coordinate's
own dependency closure to discard exclusions it could never have honoured,
costing an isolated POM download and graph resolve per candidate.

Treat any difference in declared exclusions as "not redundant" instead.
This is strictly conservative: it can only keep a dependency that was
previously removed, never the reverse.

The cost is that a transitive which merely inherited an unrelated exclusion
from an ancestor no longer compares equal to a direct declaration carrying
none, so jakarta.ws.rs-api is now kept rather than removed. That test is
retained, inverted, to document the limitation.

* Regenerate recipes.csv

Author: timtebeek

src/main/java/org/openrewrite/java/dependencies/RemoveRedundantDependencies.java

@@ -52,7 +52,7 @@ public class RemoveRedundantDependencies extends ScanningRecipe<RemoveRedundantD
                 "This recipe downloads and resolves the parent dependency's POM to determine its true transitive " +
                 "dependencies, allowing it to detect redundancies even when both dependencies are explicitly declared. " +
                 "A direct dependency is only removed when the transitive one provides it at the exact same scope and " +
-                "with the same exclusions, so that removing it does not change the effective classpath.";
+                "with the same declared exclusions, so that removing it does not change the effective classpath.";
 
     @Value
     public static class Accumulator {
@@ -145,23 +145,16 @@ private void resolveTransitivesFromPom(
                     MavenPomDownloader downloader,
                     ExecutionContext ctx,
                     Set<TransitiveDependency> transitives) {
+                List<MavenRepository> repos = withMavenCentral(repositories);
                 try {
-                    // Ensure we have Maven Central in the repositories
-                    List<MavenRepository> effectiveRepos = new ArrayList<>(repositories);
-                    if (effectiveRepos.stream().noneMatch(r -> r.getUri().contains("repo.maven.apache.org") ||
-                            r.getUri().contains("repo1.maven.org"))) {
-                        effectiveRepos.add(MavenRepository.MAVEN_CENTRAL);
-                    }
-
                     // Get the resolved dependencies for compile scope (which includes most transitives)
-                    Pom pom = downloader.download(gav.asGroupArtifactVersion(), null, null, effectiveRepos);
-                    ResolvedPom resolvedPom = pom.resolve(emptyList(), downloader, effectiveRepos, ctx);
+                    Pom pom = downloader.download(gav.asGroupArtifactVersion(), null, null, repos);
+                    ResolvedPom resolvedPom = pom.resolve(emptyList(), downloader, repos, ctx);
                     ResolvedPom patchedPom = applyExclusions(resolvedPom, effectiveExclusions);
-                    List<ResolvedDependency> resolved = patchedPom.resolveDependencies(Scope.Compile, downloader, ctx);
 
                     // Collect all dependencies (both direct and transitive of the parent)
                     Set<ResolvedGroupArtifactVersion> visited = new HashSet<>();
-                    for (ResolvedDependency dep : resolved) {
+                    for (ResolvedDependency dep : patchedPom.resolveDependencies(Scope.Compile, downloader, ctx)) {
                         collectAllDependencies(dep, transitives, visited);
                     }
                 } catch (MavenDownloadingException | MavenDownloadingExceptions e) {
@@ -182,7 +175,7 @@ private ResolvedPom applyExclusions(ResolvedPom resolvedPom, List<GroupArtifact>
             private void collectAllDependencies(ResolvedDependency dep, Set<TransitiveDependency> transitives,
                                                 Set<ResolvedGroupArtifactVersion> visited) {
                 if (visited.add(dep.getGav())) {
-                    transitives.add(new TransitiveDependency(dep.getGav(), new HashSet<>(dep.getEffectiveExclusions())));
+                    transitives.add(new TransitiveDependency(dep.getGav(), declaredExclusions(dep)));
                     for (ResolvedDependency transitive : dep.getDependencies()) {
                         collectAllDependencies(transitive, transitives, visited);
                     }
@@ -191,6 +184,23 @@ private void collectAllDependencies(ResolvedDependency dep, Set<TransitiveDepend
         };
     }
 
+    // Declared (requested) exclusions rather than effective ones: within a large tree the effective set is
+    // corrupted by dependency mediation, as an artifact excluded here may already have been pruned by a shared
+    // node elsewhere, in which case the exclusion never fires and drops out of getEffectiveExclusions().
+    private static Set<GroupArtifact> declaredExclusions(ResolvedDependency dep) {
+        List<GroupArtifact> exclusions = dep.getRequested().getExclusions();
+        return exclusions == null || exclusions.isEmpty() ? emptySet() : new HashSet<>(exclusions);
+    }
+
+    private static List<MavenRepository> withMavenCentral(List<MavenRepository> repositories) {
+        List<MavenRepository> effectiveRepos = new ArrayList<>(repositories);
+        if (effectiveRepos.stream().noneMatch(r -> r.getUri().contains("repo.maven.apache.org") ||
+                r.getUri().contains("repo1.maven.org"))) {
+            effectiveRepos.add(MavenRepository.MAVEN_CENTRAL);
+        }
+        return effectiveRepos;
+    }
+
     @Override
     public TreeVisitor<?, ExecutionContext> getVisitor(Accumulator acc) {
         return new TreeVisitor<Tree, ExecutionContext>() {
@@ -278,7 +288,7 @@ private boolean doesNotMatchArguments(ResolvedDependency dep) {
             }
 
             private boolean isRedundant(ResolvedDependency dep, Set<TransitiveDependency> transitives) {
-                Set<GroupArtifact> depExclusions = new HashSet<>(dep.getEffectiveExclusions());
+                Set<GroupArtifact> depExclusions = declaredExclusions(dep);
                 for (TransitiveDependency transitive : transitives) {
                     ResolvedGroupArtifactVersion gav = transitive.getGav();
                     if (dep.getGroupId().equals(gav.getGroupId()) &&