[slachiewicz]

Follow-up to #1793 and #1794 before 3.12.0 ships.

requireExplicitDependencies: a versionless item whose groupId and artifactId no dependency declares is reported as a violation instead of failing in the version lookup; a version range matches only when the declared range contains the item's version; the docs say what a pom declaration really does (it adds the module's transitive dependencies and shows in dependency:tree; use provided scope and a *:* exclusion to avoid that) and describe the exemption by how the goal is invoked.

overWriteFiles: the two examples that still described the old timestamp rule now say every existing file is kept; a dangling symlink at the target counts as existing; the javadoc says the first file wins when several entries map to the same path.

Verified: dependency:tree with a provided pom dependency and a *:* exclusion → only g:pomdep:pom:1.0:provided on Maven 3.9.16 and 3.10.0-rc-1

---

To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
check one of the following:

• I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004
• I hereby declare that I have filed an Apache Individual Contributor License Agreement.