Library upgrade policy should not reduce bom's policy

Library-specific upgrade policies were added to allow a dependency
to have a less strict upgrade policy, for example so that a new
minor upgrade could be applied in a maintenance release. As
currently implemented, a library-specific policy that's more
restrictive than the bom's policy may result in a possibl upgrade
being missed.

This commit updates the library-specific support to use the
maximum (most permissive) upgrade policy so that possible upgrades
are not hidden by a less permissive library-specific policy.

See gh-46369

buildSrc/src/main/java/org/springframework/boot/build/bom/UpgradePolicy.java

@@ -53,4 +53,14 @@ public enum UpgradePolicy implements BiPredicate<DependencyVersion, DependencyVe
 		return this.delegate.test(candidate, current);
 	}
 
+	public static UpgradePolicy max(UpgradePolicy one, UpgradePolicy two) {
+		if (one == null && two != null) {
+			return two;
+		}
+		else if (one != null && two == null) {
+			return one;
+		}
+		return (one.ordinal() < two.ordinal()) ? one : two;
+	}
+
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/UpgradeDependencies.java

@@ -265,10 +265,9 @@ public abstract class UpgradeDependencies extends DefaultTask {
 	}
 
 	private boolean compliesWithUpgradePolicy(Library library, DependencyVersion candidate) {
-		UpgradePolicy upgradePolicy = library.getUpgradePolicy();
-		if (upgradePolicy == null) {
-			upgradePolicy = this.bom.getUpgrade().getPolicy();
-		}
+		UpgradePolicy libraryPolicy = library.getUpgradePolicy();
+		UpgradePolicy bomPolicy = this.bom.getUpgrade().getPolicy();
+		UpgradePolicy upgradePolicy = UpgradePolicy.max(libraryPolicy, bomPolicy);
 		return upgradePolicy.test(candidate, library.getVersion().getVersion());
 	}