Maven: report declared dependencies as direct in static (pomxml) analysis

[himynameisdave]

Overview

The static Maven strategy (pomxml, used whenever mvn is not on PATH or with --static-only-analysis) builds its graph rooted at the project's own coordinate, with submodules as children of that root. Unlike the dynamic strategies, which strip those first-party nodes with shrinkRoots, the static path returned the graph as-is. Result: the project artifact (e.g. com.cascade:cascade) is the only "direct" dependency and every dependency declared in pom.xml is reported as transitive.

This PR shrinks the project and submodule nodes out of the static graph (after submodule/scope filtering), promoting their children to direct, matching what the dynamic path already does.

This affects every GitHub App / Quick Import Maven project, since Hubble always runs static-only analysis with no mvn available. Auto PRs only act on direct dependencies, so those projects currently have nothing to upgrade.

Acceptance criteria

fossa analyze on a Maven project without mvn on PATH (or with --static-only-analysis) reports the dependencies declared in pom.xml as direct, and does not report the project or its modules as dependencies.

Testing plan

Unit test added in test/Maven/PomClosureSpec.hs (getStaticAnalysis): multi-module fixture where one module declares org.example:lib:1.0; asserts that is the only vertex and it is direct.

Manual repro against https://github.com/himynameisdave/cascade-java (65 declared deps):

# before: 1 direct (com.cascade:cascade) / 65 total
# after:  65 direct / 65 total
fossa analyze --output --only-target maven --static-only-analysis \
  | jq '.sourceUnits[] | select(.Type=="maven") | {direct: (.Build.Imports|length), total: (.Build.Dependencies|length)}'

Risks

• Multi-module projects: submodules that appear as dependencies of other modules are now removed from the static graph (previously they were reported as deps). This matches the dynamic path's behaviour, but reviewers who know why the static path was left out of Ane 907 submodule filtering #1339 please shout.
• Hubble pins fossa-cli via submodule; needs a bump there after release to fix GitHub App imports.

Metrics

N/A

References

• Static path without shrinkRoots:

  fossa-cli/src/Strategy/Maven.hs

  Lines 187 to 191 in 00580ae

  	getStaticAnalysis submoduleTargets closure = do
  	let allSubmodules = PomClosure.closureSubmodules closure
  	(graph, graphBreadth) <- context "Static analysis" $ pure (Pom.analyze' closure, Partial)
  	filteredGraph <- applyMavenFilters submoduleTargets allSubmodules graph
  	pure (filteredGraph, graphBreadth)

• Dynamic path with shrinkRoots:

  fossa-cli/src/Strategy/Maven.hs

  Lines 137 to 143 in 00580ae

  	pure (withoutProjectAsDep filteredGraph, graphBreadth)
  	where
  	-- shrinkRoots is applied on all dynamic strategies.
  	-- The root deps are either the toplevel package or submodules in a multi-module project.
  	-- We don't want to consider those because they're the users' packages.
  	-- Promote them to direct when building the graph using `shrinkRoots`.
  	withoutProjectAsDep = shrinkRoots

• Root node added by buildProjectGraph:

  fossa-cli/src/Strategy/Maven/Pom.hs

  Line 105 in 00580ae

  direct (coordToPackage (closureRootCoord closure))

• shrinkRoots added to dynamic path only: Ane 907 submodule filtering #1339
• Hubble hardcodes static-only: https://github.com/fossas/hubble/blob/0327d7bd40378152e00b3810ae3dccb72600c306/src/FOSSA/Hubble/Analysis/Analyze.hs#L275