bug(pom): remove excluded deps from upper pom's

[DmitriyLewen]

Description

Trivy don't find dependencies that have been removed (exclusions tag) and added as separate dependency.
e.g. Trivy skips commons-beanutils and commons-logging:

 <dependencies>

    <dependency>
      <groupId>commons-beanutils</groupId>
      <artifactId>commons-beanutils</artifactId>
      <version>1.9.2</version>
    </dependency>

    <dependency>
      <groupId>commons-digester</groupId>
      <artifactId>commons-digester</artifactId>
      <version>1.8.1</version>
      <!-- exclude older version and use declared-only -->
      <exclusions>
        <exclusion>
          <groupId>commons-beanutils</groupId>
          <artifactId>commons-beanutils</artifactId>
        </exclusion>
        <exclusion>
          <groupId>commons-logging</groupId>
          <artifactId>commons-logging</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>commons-logging</groupId>
      <artifactId>commons-logging</artifactId>
      <version>1.2</version>
    </dependency>

Discussed in #5826