spring-boot-security brings test dependencies

[marcrohlfs]

module/spring-boot-security/build.gradle declares api(project(":core:spring-boot-test-autoconfigure")). I think it should rather be scoped with testImplementation. This api scoping transitively brings the spring-boot-test and spring-test into production dependencies, too.

We noticed this, because we're banning test dependencies from non-test classpaths and got the following error:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.6.2:enforce (enforce-onerepo-rules) on project foo-bar:
[ERROR] Rule 2: com.coremedia.maven.enforcer.BannedDependenciesRule(bannedDependencies) failed with message:
[ERROR] com.acme:foo-bar:jar:1.0-SNAPSHOT
[ERROR]    org.springframework.boot:spring-boot-security:jar:4.0.0-RC1
[ERROR]       org.springframework.boot:spring-boot-test-autoconfigure:jar:4.0.0-RC1
[ERROR]          org.springframework.boot:spring-boot-test:jar:4.0.0-RC1 <--- banned via the exclude/include list

[wilkinsona]

Thanks for trying the RC and for reporting this.

I don't think the dependency should be there at all. Instead, it should be in spring-boot-security-test.