Summary

This PR adds BOM support along the lines of eed3si9n’s comment on #4531:

For the consumption, we reuse the existing .pomOnly() construct:

libraryDependendencies += ("com.fasterxml.jackson" % "jackson-bom" % "2.21.0").pomOnly()

Interestingly https://mvnrepository.com/artifact/com.fasterxml.jackson/jackson-bom/2.21.0 even suggests that sbt users use that. Next we'd need a way to specify a versionless dependency. For now, we can use "*" for example:

libraryDependendencies += "com.fasterxml.jackson.core" % "jackson-core" % "*"

Expectation

1. The resulting update contains jackson-core 2.21.0
2. makePom translates POM-only dependencies to

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.fasterxml.jackson</groupId>
        <artifactId>jackson-bom</artifactId>
        <version>2.21.0</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

What’s in this PR

Consuming BOMs

• You can declare a BOM with .pomOnly() and versionless deps with "*":
  • libraryDependencies += ("com.fasterxml.jackson" % "jackson-bom" % "2.21.0").pomOnly()
  • libraryDependencies += "com.fasterxml.jackson.core" % "jackson-core" % "*"
• BOMs are passed to Coursier via Resolve.addBom(); version "*" is resolved from the BOM.

makePom

• POM-only dependencies are emitted under <dependencyManagement><dependencies>...</dependencies></dependencyManagement> with <type>pom</type> and <scope>import</scope>.
• Dependencies with version "*" are emitted without a <version> element so Maven uses the BOM-managed version.

Implementation

• lm-coursier: dependencies with only a pom artifact are treated as BOMs and passed to Resolve.withBoms(); the rest stay as normal dependencies (including "*").
• lm-ivy (MakePom): BOM deps go into <dependencyManagement>; "*" version is omitted in the dependency element. Scala 3: explicit NodeSeq/Elem types in makeDependencyElem to fix cyclic inference and return type.
• Removed the previous custom BOM path (csrBomDependencies, BomSupport, PomParser) in favor of Coursier’s native addBom support.

Ivy / publishLocal emulation

• When publishing to Ivy (e.g. publishLocal), BOM-resolved versions (deps that had "*") are written into the published ivy.xml as forced dependencies (force="true"), so consumers that depend on this module get those versions.

Scripted test

• dependency-management/bom: BOM (jackson-bom 2.21.0 .pomOnly()) + jackson-core "*"; asserts resolved version is 2.21.0.
• Per eed3si9n’s suggestion, the scripted test validates Coursier’s BOM behavior on this feature branch before opening the PR.

How to verify

From the sbt build root:

./sbt "scripted dependency-management/bom"

Fixes #4531