feat(java): add empty versions if pom.xml dependency versions can't be detected

[DmitriyLewen]

Description

See #7446

example:

➜ ./trivy -d fs -f json --list-all-pkgs ./pkg/dependency/parser/java/pom/testdata/dep-without-version/pom.xml | jq .Results
...
2024-09-23T09:52:33+06:00       WARN    [pom] Dependency version cannot be determined. Child dependencies will not be found.    details="https://aquasecurity.github.io/trivy/dev/docs/coverage/language/java#empty-dependency-version"
2024-09-23T09:52:33+06:00       DEBUG   [pom] Dependency version cannot be determined.  GroupID="org.example" ArtifactID="example-api"
...
[
  {
    "Target": "pom.xml",
    "Class": "lang-pkgs",
    "Type": "pom",
    "Packages": [
      {
        "ID": "com.example:dep-without-version:1.0.0",
        "Name": "com.example:dep-without-version",
        "Identifier": {
          "PURL": "pkg:maven/com.example/dep-without-version@1.0.0",
          "UID": "f45bbf801c535e36"
        },
        "Version": "1.0.0",
        "Relationship": "root",
        "Layer": {}
      },
      {
        "ID": "org.example:example-api",
        "Name": "org.example:example-api",
        "Identifier": {
          "PURL": "pkg:maven/org.example/example-api",
          "UID": "2defcd5e48da76ac"
        },
        "Relationship": "direct",
        "Layer": {},
        "Locations": [
          {
            "StartLine": 19,
            "EndLine": 22
          }
        ]
      }
    ]
  }
]

Related issues

• Close feat(pom): add empty versions if dependency versions cannot be detected #7446

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

We may want to show warnings with group id and artifact id. Can it be overwhelming?

[DmitriyLewen]

I decided to show the warning once to avoid spam in logs
do you think we should still show all dependencies without the version?

[knqyf263]

One warning without dependency details and other debug logs with group id and artifact id may be a good compromise.

[DmitriyLewen]

updated in 9424f13