Associates or friends leak the internals of their compile classpath

[Bencodes]

The flatten jar macro currently collects the entire compilation classpath of any target passed is as an associate which gives access to all of the Kotlin internal functions of not just the direct associate dependencies, but all of the compile time jars provided by the associate dependencies.

rules_kotlin/kotlin/internal/jvm/associates.bzl

Lines 55 to 67 in e1a92bc

	def _flatten_jars(nested_jars_depset):
	"""Returns a list of strings containing the compile_jars for depset of targets.
	This ends up unwinding the nesting of depsets, since compile_jars contains depsets inside
	the nested_jars targets, which themselves are depsets. This function is intended to be called
	lazily form within Args.add_all(map_each) as it collapses depsets.
	"""
	compile_jars_depsets = [
	target[JavaInfo].compile_jars
	for target in nested_jars_depset.to_list()
	if target[JavaInfo].compile_jars
	]
	return [file.path for file in depset(transitive = compile_jars_depsets).to_list()]

[Bencodes]

Assuming this is not the intended behavior, replacing the JavaInfo#compile_jars with just the direct outputs will likely be a breaking change for some people and need to be feature flagged and gradually rolled out.

[restingbull]

This is implementing strict associates. Flag it?