Fix BF skipper handling of version-range candidates

[efegokdemir]

The breadth-first dependency collector can skip the descriptor of a range-constrained candidate as a version conflict loser based on a previously visited artifact with the same versionless key. If conflict resolution selects that candidate, its transitive dependencies are missing.

Resolve range-constrained candidates so their dependencies remain available to conflict resolution, but do not let them replace the cached versionless winner. Exact-artifact duplicate caching remains in place. Added collector and skipper regressions.

The reported build fails on Maven 3.10.0 and 4.0.0-rc-7, passes on Maven 3.9.12, and passes with Resolver 2.0.25-SNAPSHOT on Maven 3.10.0 and 4.0.0-rc-7. Resolver validation: mvn -Prun-its verify (31 modules) and the focused skipper tests (28 passed).

Related: apache/maven#13430.

• I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004
• I hereby declare that I have filed an Apache Individual Contributor License Agreement.

[gnodet-bot]

LGTM. Correct, minimal fix for a real bug where the BF skipper's versionless-key conflict detection wrongly discarded the transitive dependencies of range-resolved candidates.

Pre-fix test validation: Both new tests were confirmed failing before the fix and passing after (reverting only the production file on the PR branch). The full existing suite (28 skipper/collector tests) also passes.

Logic: isRangeDependency() correctly identifies only nodes with a non-null VersionConstraint.getRange() — soft pinned versions (getRange() == null) are unaffected. Exempting range candidates from winnerGAs is intentional and correct: the original pinned winner retains the versionless slot, while the range candidate is still tracked in winners for exact-duplicate detection (so if it resolves to the same version as an already-seen exact dep, it's still skipped as a duplicate).

Test fixtures: The INI topology (root→{parent:1, library:1}, parent:1→library:[2,4), library:3→range-asset:1) correctly exercises the bug scenario — library:1 is visited first and cached as the versionless winner, then library:[2,4) resolves to library:3 which was previously being wrongly skipped.

One note: the pre-existing mutable-collection-return finding from static analysis on getResults() is not introduced by this PR.

This review was generated by an AI agent, Hermès on behalf of @gnodet.