Fix dependency management logic resolution order

[shanman190]

What's changed?

• Maven does not merge managed dependency attributes. It replaces them entirely.
• When a managed dependency doesn't have a version, it short circuits and effectively removes the managed dependency rules.
• Given we resolve managed versions starting from the closest, then going to the furthest entries, we should retain the first encountered entry. If that entry comes from a BOM, then the nearest parent managed dependency can override it.

What's your motivation?

Encountered a diamond problem which illustrated an issue with managed dependency handling.

Anything in particular you'd like reviewers to focus on?

N/A

Anyone you would like to review specifically?

@timtebeek @sambsnyd

Have you considered any alternatives or workarounds?

N/A

Any additional context

I did clean up one extra test to be a bit more idiomatic with OpenRewrite standards.

Checklist

• I've added unit tests to cover both positive and negative cases
• I've read and applied the recipe conventions and best practices
• I've used the IntelliJ IDEA auto-formatter on affected files

[timtebeek]

Nice find, thanks! Couple quick suggestions, but otherwise looks ok to me.

[sambsnyd]

I agree with Tim's feedback about the tests

[timtebeek]

Thanks a lot for the research, fix and adjustments!