Better support for multi-project repositories for `dependency-submission` about actions HOT 2 OPEN

In the original implementation, we attempted to attribute each dependency to the source file where it was declared. This turned out to be impractical.
https://github.com/gradle/actions/blob/main/docs/dependency-submission-faq.md#why-arent-dependencies-be-linked-to-the-source-file-where-they-are-declared

We also tried creating a separate dependency graph for each subproject, but this was also problematic. Many dependencies are resolved in many different projects, and GitHub would treat each of these as a separate dependency usage. This would result in many duplicate security alerts being created. (Imagine a 100 project build where every project used dependency X: then 100 dependency alerts would be created).

We are working with GitHub to come up with a Dependency Graph model that is more suitable for Gradle. In the meantime, feel free to experiment with the Dependency Graph Plugin and see what can be generated.

from actions.

I understand it's not ideal, but these docs demonstrate the current best practise for determining the underlying cause of a dependency alert: https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#resolving-a-dependency-vulnerability

from actions.