[Backport 4.0.x] [MNG-11147] Fix BOM version inference for sibling modules in dependencyManagement

[gnodet]

Backport of #12416 to maven-4.0.x for inclusion in RC-6.

Version and groupId inference in transformFileToRaw was only applied to direct dependencies but not to dependencies declared in <dependencyManagement>. This caused installed consumer BOMs to be missing version tags for reactor sibling modules, making the BOM unusable by downstream consumers.

Extracts the inference loop into a reusable inferDependencies helper and applies it to both <dependencies> and <dependencyManagement>.

Closes #11147

[gnodet]

Code Review

LGTM — Clean backport of merged PR #12416 to maven-4.0.x for RC-6.

The production code changes are content-identical to the original (already reviewed and approved). The refactoring correctly extracts version/groupId inference into a reusable inferDependencies helper and applies it to both <dependencies> and <dependencyManagement>, fixing the BOM version inference gap for reactor sibling modules.

Null safety is properly handled (depMgmt checked before access, newManagedDeps/newDeps only dereferenced when their changed flag is true). The included unit test validates the core scenario — a BOM subproject declaring a reactor sibling in dependencyManagement without a version tag.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet