Exported target pom does not include exclusions

[JohnnyMorganz]

Using the examples in the documentation, consider the following setup:

# MODULE.bazel
bazel_dep(name = "rules_jvm_external", version = "6.1")
maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
maven.artifact(
    artifact = "grpc-core",
    exclusions = ["io.grpc:grpc-util"],
    group = "io.grpc",
    version = "1.58.0"
)
maven.install(
    artifacts = [],
    lock_file = "//:maven_install.json"
)
use_repo(maven, "maven", "unpinned_maven")

# library/BUILD.bazel
load("@rules_jvm_external//:defs.bzl", "java_export")

java_export(
  name = "exported_lib",
  maven_coordinates = "com.example:project:0.0.1",
  srcs = [],
  runtime_deps = [
    "@maven//:io_grpc_grpc_core",
  ],
)

If we build the generated pom for exported_lib, we get the following output:

<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>project</artifactId>
    <version>0.0.1</version>

    <dependencies>
        <dependency>
            <groupId>io.grpc</groupId>
            <artifactId>grpc-core</artifactId>
            <version>1.58.0</version>
        </dependency>
    </dependencies>
</project>

The dependency definition for grpc-core is missing the exclusion of grpc-util. This exclusion is important to keep for downstream consumers.

We used to work around this because exclusions were stored in the old maven_install.json format (4.X). However we want to now upgrade to 6.1 with the newer lockfile format, but it does not include exclusions information anymore.

I think this could be done by extending MavenInfo and https://github.com/bazelbuild/rules_jvm_external/blob/master/private/rules/has_maven_deps.bzl to pick up exclusions, then wiring it into the pom.xml. Maybe jvm_import should store exclusions in an attribute, or it should be tag based?