[EAGLE-1102] Integrate CVE maven plugin

[grainier]

Purpose

Purpose of this pull request is to integrate the CVE maven plugin for eagle to check security vulnerabilities in dependencies during build time. This will help to detect publicly disclosed vulnerabilities contained within eagle's dependencies (and the dependencies of all child modules).

Usage

This plugin configuration is attached to the mvn verify phase. Therefore, this will run automatically when we perform a mvn clean verify. Once the mvn process is completed, the plugin will create a dependency-check-report.html report in target/ dir with the detect vulnerabilities.

In case if you need to skip this plugin, use owasp.check.skip=true property (i.e mvn clean verify -Dowasp.check.skip=true).

Remarks

• Fixes https://issues.apache.org/jira/browse/EAGLE-1102
• https://issues.apache.org/jira/browse/EAGLE-1100
• https://github.com/jeremylong/DependencyCheck
• https://jeremylong.github.io/DependencyCheck/dependency-check-maven/aggregate-mojo.html
• https://jeremylong.github.io/DependencyCheck/general/suppression.html

---

Be sure to do all of the following to help us incorporate your contribution
quickly and easily:

• Make sure the PR title is formatted like:
  [EAGLE-<Jira issue #>] Description of pull request
• Make sure tests pass via mvn clean verify. (Even better, enable
  Travis-CI on your fork and ensure the whole test matrix passes).
• Replace <Jira issue #> in the title with the actual Jira issue
  number, if there is one.
• If this contribution is large, please file an Apache
  Individual Contributor License Agreement.

---

[haoch]

@grainier Could you please attach the CVE alerts on the jira/PR as well?

[grainier]

@haoch It's attached on the parent issue [1]. And the dependency-check-report.html can be found on [2].

[1] https://issues.apache.org/jira/browse/EAGLE-1100
[2] https://issues.apache.org/jira/secure/attachment/12982206/dependency-check-report.html

[haoch]

LGTM, thanks @grainier