I think it would make sense to also search transitive dependencies for the banned artifacts since this is what ultimately happened in case of Apache HttpClient pulling in Apache Commons Logging.

See `searchTransitive` on https://maven.apache.org/enforcer/enforcer-rules/bannedDependencies.html