[2.8.x] Restore behaviour where we only scanned a subset of plugin dependencies

Do this while we still have the list of 'shared' URLs from the plugin manager. Once we move away from the old embedded jar+dependencies packaging to individual non-embedded bundles this won't be needed, because we can then tailor the scanning to each individual bundle rather than applying the same scanning across all embedded jars.

https://bamboo.zion.sonatype.com/browse/NX-OSSF3-1 :white_check_mark: