kie-server-client transitively depends on non-existing javassist 3.19.0.GA-redhat-1

This issue was originally encountered by rhn-support-agiertli (thanks for bringing this up!)

kie-server-client in version 6.4.0.Final-redhat-6 depends on org.reflections:reflections:0.9.10.redhat-3, which in turn depends on org.javasisst:javassist:3.19.0-GA-redhat-1. However, this javassist version is not publicly available (obviously not in Central, but also not in the Red Hat product repository https://maven.repository.redhat.com/ga).

Previous versions of kie-server-client used org.reflections:reflections:0.9.10 (the original, not internally rebuild version), which actually depends on different javassist version! (3.18.2-GA). I would expect that the internal rebuilds do not change the dependency versions, but I know that's not always the case.

Workaround is to override the javassist version in dependencyManagement. However, I believe we need to make sure this works OOTB (by adding that javassist version into the Red Hat product repository).

Attached POM file serves as a reproducer.

This is a new issue in 6.3.1, it was working with 6.3.0.

This will likely be an issue for any module that depends on org.reflections:reflections as the version is defined in one of the parents (ip-bom-parent).