Update snapshot tests to integrate new custom-json-diff functionality.

[cerrussell]

Changes

• I have ugraded the functionality in custom-json-diff to better handle bom diffing
• Handles version issue
• Produces an HTML report in addition to the JSON
• Comparison is of defined bom objects which allows for better control for different use cases

Notes on the current configuration of the tests

• Will pass if the newly generated bom has the same components or dependencies at equal or greater versions. This also means that purl and bom-ref will not be used in the comparison given they will not be the same in such a scenario.
• Will pass if the snapshot bom has empty fields and the newly generated bom has populated these fields
• Includes licenses, properties, and evidence in comparison but not hashes

@prabhu @setchy I have tested with the snapshots, updated the ones which required updating (properties expanded for a couple) and there's one thing I need to check on.

Change of scope from optional to required for bouncy castles dependencies for netty. The netty pom indicates these are optional. Thoughts?

{
  "bom-ref": "pkg:maven/org.bouncycastle/bcpkix-jdk15on@1.69?type=jar",
  "description": "The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.",
  "name": "bcpkix-jdk15on",
  "purl": "pkg:maven/org.bouncycastle/bcpkix-jdk15on@1.69?type=jar",
  "scope": "optional",
  "type": "framework",
  "version": "1.69"
}

{
  "bom-ref": "pkg:maven/org.bouncycastle/bcpkix-jdk15on@1.69?type=jar",
  "description": "The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.",
  "name": "bcpkix-jdk15on",
  "purl": "pkg:maven/org.bouncycastle/bcpkix-jdk15on@1.69?type=jar",
  "scope": "required",
  "type": "framework",
  "version": "1.69"
}

<dependency>
  <groupId>org.bouncycastle</groupId>
  <artifactId>bcpkix-jdk15on</artifactId>
  <version>1.69</version>
  <scope>compile</scope>
  <optional>true</optional>
</dependency>

<!--
  Completely optional and only needed for OCSP stapling to construct and
  parse OCSP requests and responses.
-->
<dependency>
  <groupId>org.bouncycastle</groupId>
  <artifactId>bcprov-jdk15on</artifactId>
  <version>1.69</version>
  <scope>compile</scope>
  <optional>true</optional>
</dependency>

<!--
  Completely optional and only needed for ALPN.
-->
<dependency>
  <groupId>org.bouncycastle</groupId>
  <artifactId>bctls-jdk15on</artifactId>
  <version>1.69</version>
  <scope>compile</scope>
  <optional>true</optional>
</dependency>

Closes #1112

[prabhu]

@cerrussell, Impressive work!

Change of scope from optional to required for bouncy castles dependencies for netty

I think the cyclonedx maven plugin currently over-reports required dependencies. I noticed this while trying the new maven deps tree approach using the environment variable PREFER_MAVEN_DEPS_TREE=true. Are you seeing the differences upon repeated runs for the same project?

[cerrussell]

@prabhu I don't have PREFER_MAVEN_DEPS_TREE=true but I get this for netty@7ad2b91515b3affaeadb4b2975cd6d2a8342c403

[prabhu]

@cerrussell any updates? Did you get a chance to test the last two versions of the cyclonedx maven plugin directly?

[cerrussell]

@prabhu I ran the maven plugin directly and got the same thing. However, I did a bit of digging and I think what's actually happened is the devs at netty thought they had made these dependencies optional but because of the way one of their plugins worked, they were mandatory. This commit (Remove unwanted mandatory dependency in OSGi) details what happened and it makes sense why cyclonedx maven plugin changed what were intended to be optional dependencies to required... it is actually correct.

I'm therefore going to update the netty bom and then we should be good to go.

[cerrussell]

@prabhu @setchy ready for review