Package Import / Export analyser does not fail if an internal bundle is included and accesses internal API

[cziegeler]

If a bundle is included which is the same as a bundle we have in the internal region, then the user bundle is currently granted access to the internal API; I assume it is treated like the internal bundle
For example including com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.17.1 does not result in an error, although it is accessing snakeyaml which is not public api

[cziegeler]

The features are aggregated with the "ALL" merging rule, meaning that if the same artifact is in the source and the target feature than both end up in the target. However, if the artifacts are identical (same version as well), then this gets merged into a single artifact (which makes sense in the general case)