Require transitively io.vertx.auth.common module

[tsegismont]

This module is required by Vert.x Web applications even when no Vert.x Auth handler is used.

Indeed, Vert.x Web uses the SecurityAudit class in several places.

Instead of making all JPMS users of Vert.x Web require that module explicitly, we should make it a transitive requirement.

[vietj]

the issue with this is that we might have to add many transitive requires for other modules like vertx-core and I would prefer we first define clearly how we operate if we go this way

[tsegismont]

Thinking about an RFC?

[vietj]

thinking about understanding first what are the implications and best practices:

• if we add an extra transitive and remove it after (because it was actually not needed), is it considered as a breaking change ?
• how to keep a minimal set of transitive, e.g. if vertx-web depends on vertx-web-common and vertx-web-common requires transitively vertx-core, then vertx-web does not need to declare it transitively ?

[tsegismont]

These are good questions, indeed. I'll add that to an RFC, unless you prefer some other material

[tsegismont]

In fact, the problem is not that the Vert.x Web module should transitively require the Vert.x Auth Common module. The SecurityAudit class is not necessary for users, it's required by Vert.x Web only.

So we should change the declaration, but only to a simple requirement, not transitive. I'll send another PR

[tsegismont]

See #2716