dependencyManagement can be used to manage the transitive dependency
versions not only direct ones, and this impacts what can end up in the
resulting hpi file.

By not including the depMgmt section then any downtream consumer will
see the un managed versions of the dependencies which will differ from
what they should see

the OSS mode despite saying it keeps everything "repositories and
pluginRepositories" does not and it throws away the dependencyManagement

this creates our own descriptor that dies the same as the oss mode
currently but additionally keeps the dependencyManagement section

Whilst we could have used resolveCiFriendliesOnly which is probably a
better solution so that the poms behave better regardless of if they are
deployed from CI or local snapshots this keeps the changes to published
poms minimal

as discussed with @jglick as the intention of the flatten plugin here is to have
a self contained pom - this will switch to expand which will also have the benefit
of picking up any <dependencyManagement> configured in the parent(s).