there's a maven plugin which adds OSGI metadata

because it's missing, there are quite a few projects which wrap the library to add headers, this causes security scanners to miss flagging outdated versions

https://felix.apache.org/documentation/subprojects/apache-felix-maven-bundle-plugin-bnd.html