Fix profile resolve duplicate controls

[selenaxiao-nist]

Committer Notes

Fixes #360

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Do all automated CI/CD checks pass?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you included examples of how to use your new feature(s)?
• Have you updated all website and readme documentation affected by the changes you made?

[selenaxiao-nist]

@newxorouz
From my testing, building liboscal-java from this branch and then rebuilding oscal-cli should resolve the issue you opened usnistgov/oscal-cli#315. Could you verify on your end?

[newxorouz]

@newxorouz From my testing, building liboscal-java from this branch and then rebuilding oscal-cli should resolve the issue you opened usnistgov/oscal-cli#315. Could you verify on your end?

Yes, when I run with these changes it does indeed resolve the profile as expected

[selenaxiao-nist]

Thanks @newxorouz

@iMichaela could you please review as well and approve for merging? Thank you.

[iMichaela]

Builds locally with no issues as long as local Java version is not higher than 21 because the pom file sets maven.compiler.release=11 and binds maven-toolchains-plugin to jdk 11 / Temurin, and the jar produced on Temurin 21 is the same Java 11 bytecode compiled by the same Temurin 11 compiler. Any higher Java version will cause SpotBugs 4.7.3.4 to fail because it ships an ASM that only understands up to Java 21 (as tested).