Use overrides defined in <plugin><dependencies>

[bjansen]

Description of Change

This is a fix for #8570. When scanPlugins is enabled and a maven plugin pulls a vulnerable dependency, it is possible to override the dependency like this:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-clean-plugin</artifactId>
    <version>3.5.0</version>
    <dependencies>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
            <version>4.0.3</version>
        </dependency>
    </dependencies>
</plugin>

This change makes dependency-check take these overrides into account when looking for vulnerable dependencies.

Related issues

Fixes #8570

Have test cases been added to cover the new functionality?

yes