[MRESOLVER-388] Proper overide of commons-codec (#320)

---

https://issues.apache.org/jira/browse/MRESOLVER-388

maven-resolver-transport-http/pom.xml

@@ -37,17 +37,6 @@
  <jettyVersion>9.4.51.v20230217</jettyVersion>
  </properties>
 
- <dependencyManagement>
- <dependencies>
- <!-- HttpClient pulls in 1.11 that has CVE. Is not used directly in code -->
- <dependency>
- <groupId>commons-codec</groupId>
- <artifactId>commons-codec</artifactId>
- <version>1.15</version>
- </dependency>
- </dependencies>
- </dependencyManagement>
-
  <dependencies>
  <dependency>
  <groupId>org.apache.maven.resolver</groupId>
@@ -71,13 +60,24 @@
  <groupId>commons-logging</groupId>
  <artifactId>commons-logging</artifactId>
  </exclusion>
+ <exclusion>
+ <!-- httpclient uses old codec -->
+ <groupId>commons-codec</groupId>
+ <artifactId>commons-codec</artifactId>
+ </exclusion>
  </exclusions>
  </dependency>
  <dependency>
  <groupId>org.apache.httpcomponents</groupId>
  <artifactId>httpcore</artifactId>
  <version>4.4.16</version>
  </dependency>
+ <dependency>
+ <groupId>commons-codec</groupId>
+ <artifactId>commons-codec</artifactId>
+ <version>1.15</version>
+ <scope>runtime</scope>
+ </dependency>
  <dependency>
  <groupId>org.slf4j</groupId>
  <artifactId>jcl-over-slf4j</artifactId>