fix(java): don't inherit a relativePath POM that only matches the parent ArtifactID

[sueun-dev]

Description

tryRelativePath resolves a <parent> declared with a relativePath (or the default ../pom.xml). It first matches the local POM's ArtifactID against the declared parent, because resolveParent hasn't run yet and the GroupID/Version aren't available. After resolveParent fills those in, it re-checks the identity with artifact.Equal:

func (a artifact) Equal(o artifact) bool {
	return a.GroupID == o.GroupID || a.ArtifactID == o.ArtifactID || a.Version.String() == o.Version.String()
}

The fields are combined with ||, so Equal returns true whenever any single field matches. The ArtifactID is already guaranteed equal by the first check, so the second check can never reject anything. A ../pom.xml (or relativePath target) that shares the ArtifactID but has a different GroupID is then treated as the parent, and its dependencies/dependencyManagement are inherited — dependencies that aren't really there end up in the SBOM graph.

Example: a module declares parent com.example:parent:1.0.0, but the sibling ./parent/pom.xml is an unrelated com.unrelated:parent:9.9.9 that depends on org.phantom:phantom-lib:6.6.6. Before this change phantom-lib is reported as a dependency of the module; after it isn't.

This compares the resolved GroupID at that call site instead. The declared parent Version can still be an unevaluated property (e.g. ${revision}) there, so comparing it would reject valid parents — the parent version in property and inherit parent dependencies tests exercise exactly that — and it is left out. The now-unused artifact.Equal helper is removed.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.