FR: spotbugs: allow passing transitive dependencies as -auxclasspath

This allows spotbugs to see transitive dependencies but not analyze them, so only use as extra context for analysis of main code

Arguably this could be a default, and existing option for analyzing transitive dependencies along with main code be a 2nd mode. Or there could be 3 modes for transitive deps: ignore, lookup, analyze