> when it comes to opm-core the dependency on cJSON is Required

The dependencies are not transitive; opm-core depends only on cJSON if it actually includes one of its headers *directly*. Findopm-parser.cmake should (anyway) put whereever it found cJSON in ${opm-parser_LIBRARIES} and/or ${opm-parser_INCLUDE_DIRS}, so it'll be included from there at least. (And the OpmFind machinery takes care of building a complete list of whatever is required totally).