Feature/803 include other dependencies in vulnerability report

[ArBridgeman]

closes #803

Checklist

Note: If any of the items in the checklist are not relevant to your PR, just check the box.

For any Pull Request

Is the following correct:

• the title of the Pull Request?
• the title of the corresponding issue?
• there are no other open Pull Requests for the same update/change?
• that the issue which this Pull Request fixes ("Fixes...") is mentioned?

When Changes Were Made

Did you:

• update the changelog?
• update the cookiecutter-template?
• update the implementation?
• check coverage and add tests: unit tests and, if relevant, integration tests?
• update the User Guide & other documentation?
• resolve any failing CI criteria (incl. Sonar quality gate)?

When Preparing a Release

Have you:

• thought about version number (major, minor, patch)?
• checked Exasol packages for updates and resolved open vulnerabilities, if easily possible?

[ArBridgeman]

If we think it's worthwhile to differentiate main and optional dependency groups, then we will need to make an issue for it.

While we could add snippet to capture optional-dependency groups in this property (PoetryToml.groups). This would be problematic when the groups are then used in PoetryDependencies.direct_dependencies, as the command to extract which groups goes with which dependencies will not work:

[
 "poetry",
 "show",
 "--top-level",
 f"--only={group.name}",
 "--no-truncate
}

In fact, there is not a way to differentiate between main and optional-dependencies from this command, which means current optional-dependencies (when they exist in a project) are already under main. Additionally, as the PEP-compliance of poetry continues to involve, it might be foolhardy for us to try to extract this ourselves from the pyproject.toml, and in the poetry.lock, the markings overlap, meaning one cannot say it is directly from main, transitive, etc.

So it would need to be thought about how one could approach this with minimal effort.

[ArBridgeman]

See https://github.com/exasol/python-toolbox/pull/806/changes#r3145359536 for a reference of what I described above with optional dependencies being reported in main.

[ArBridgeman]

Reference point to point out that "ruff", an optional dependency, is reported already but in the main ones.