Provide a mechanism to define dependencies that can be only used by a customizer

[snicoll]

If a dependency requires a given bom and the dependency is swapped based on context (i.e. in a customizer) then the original dependency is lost and any metadata attached to it.

[snicoll]

Things are a bit more logical now: if we remove a dependency, everything goes away, including the BOM that dependency was requiring. So we can no longer swap a dependency by an hardcoded one in a customizer as the new dependency will not have a metadata entry. If we don't have a metadata entry, we can't really augment the build properly (so typically the bom is lost).

It would be nice we made sure that every dependency we touch has proper metadata (unless they are really secondary artifact). Having the ability to define metadata for an entry without having that appearing in search would be ideal and it would simplify the customizers too.

[snicoll]

It can lead to subtle issue if the model does not contain the information that we need. Turns out the hot fix was wrong, see spring-io/start.spring.io#53

[snicoll]

I guess what we should be after here is a way to express additional dependencies without them being added as an entry on the site. That way we can craft whatever they require (bom, repository, etc) and proper version mapping/version range can apply to them as well.

If we did that, then this issue would become irrelevant. We'd just add the dependency we need and it would just work.