Various dependency scope mistakes (incorrect "test" scope) across the codebase (driven by maven-dependency-plugin failures/errors)

I'm filing this issue to track the larger "dependency scope" problem I stumbled on and attempted to do a partial fix of one specific case in #11316. After talking with @pstackle we prefer to try to solve the problem across the board rather than playing whack-a-mole.

In a number of cases, I have identified various <dependency> blocks where <scope>test</scope> is declared, overriding a compile-time transitive dependency (in non-Maven lingo, a "runtime" dependency) to a test-scope dependency simply to satisfy the build failure error generated by maven-dependency-plugin. The result is that the tests pass, but anyone relying on Maven's dependency resolution for direct references to an affected module is likely going to get NoClassDefFoundErrors at runtime.

Current known examples:

• dropwizard-request-logging
  • jetty-security and jetty-session (transitively relied upon by jetty-ee10-servlet, which is in compile scope).
  • jackson-databind (transitively relied upon by dropwizard-jackson, which is in compile scope)

There will likely be many across the codebase.

The fundamental problem with maven-dependency-plugin is tracked here:

• https://issues.apache.org/jira/browse/MDEP-791
• https://github.com/apache/maven-dependency-plugin/issues/1297

Both issues are closed out as basically WON'T FIX. They claim the problem is in Maven itself and point at https://github.com/apache/maven/issues/7682. I tend to disagree (IMO, the plugin simply needs to walk the dependency tree to filter out false 'test scope' claims, but I admit I'm no expert about Maven internals. Maybe there is some implementation issue that prevents that.)

Anyway, there will not be any fix for this anytime soon. At present, the only workaround recommended is to set:

<ignoredNonTestScopedDependencies>
   <ignoredNonTestScopedDependency>*</ignoredNonTestScopedDependency>
</ignoredNonTestScopedDependencies>

If I get consensus from everyone, I'm happy to take an action to:

1. Set that workaround across the project.
2. Audit/fix all the existing 'incorrect scope' issues in the repo right now.