Submit only runtimeClasspath to the dependency graph

The submission put every configuration the build resolves into the graph: buildSrc with JReleaser,
the root buildscript's plugins, annotation processors and test dependencies, 452 packages in all.
DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS only labelled everything but runtimeClasspath as
'development'. Dependabot alerts on development dependencies all the same, and the auto-triage rule
the comment counted on to dismiss them was never created, so all 24 open alerts, the critical
tika-core one among them, are for build tooling.

Filter the graph instead. Everything that ships is built from runtimeClasspath, so the graph keeps
the same 24 runtime packages and drops the rest. With no scope parameter the packages carry no
scope, which nothing here reads.

Author: abashev

.github/workflows/dependency-submission.yml

@@ -21,8 +21,11 @@ jobs:
 
       - name: Submit Dependency Snapshot
         uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-        env:
-          # Only runtime-classpath dependencies of the published modules count as 'runtime';
-          # annotation processors, Gradle plugin classpaths and test-only dependencies are
-          # reported as 'development' so Dependabot auto-triage rules can dismiss their alerts.
-          DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: 'runtimeClasspath'
+        with:
+          # Only what ships goes into the graph. The published jars, the native image and the IntelliJ and
+          # Eclipse plugins are all built from runtimeClasspath, and the formatter configuration the IntelliJ
+          # plugin also bundles is open-java-format's runtimeClasspath again. The name is matched whole, so
+          # testRuntimeClasspath stays out. Without the filter the graph holds every configuration the build
+          # resolves, buildSrc with JReleaser and the root buildscript's plugins included, and Dependabot
+          # raises alerts for all of it: marking a dependency 'development' does not stop an alert.
+          dependency-graph-include-configurations: 'runtimeClasspath'