Excluded transitive dependencies can cause lockfile to be in a bad state

[dellisd]

1. Imagine both the base and feature modules transitively depend on Guava.
2. In the base module, some dependency excludes some of Guava's transitive dependencies.
3. The feature module depends on a newer version of Guava
4. When the lockfile is merged, this plugin will take the newer of the two versions from the feature module including its whole transitive dependency subtree
5. This will pull in Guava's transitive deps that were excluded from the base module
6. This puts the lockfile in a bad state because it will include transitive deps that will not be resolved in the base module.