Add clarification about package.properties not providing automatic discovery

[javier-godoy]

From the description of JAR Packages Scanning it's not clear that "the package.properties feature is not about automatically discovering annotated classes in external JARs, but to improve Flow class scanning by allowing JARs to filter out their own unnecessary packages" (as mentioned by @mcollovati in https://vaadin.com/forum/t/any-simple-markdown-viewer/167646/17)

If you think this issue is important, add a 👍 reaction to help the community and maintainers prioritize this issue.

[mlopezFC]

From the docs:

The package.properties file effects only the target JAR content. It supports vaadin.allowed-packages and vaadin.blocked-packages properties in the same way as in the application.properties file. The vaadin.blocked-jar=true property is used to disable scanning of the JAR, entirely.

From that text I assume that "It supports vaadin.allowed-packages and vaadin.blocked-packages properties in the same way as in the application.properties file" meaning that if I add vaadin.allowed-packages with my package, it will automatically discover the add-ons on that jar when doing the scanning.
By the way, why is that the automatic discovery of add-ons is not supported? .. It could be implemented in such a way that if (for some reason) you have the add-on dependency but you don't want it to be scanned, you could disable those packages from the application.properties (of course it should have more relevance than package.properties from add-ons).

[mcollovati]

IIRC also the settings in application.properties do not activate any discovery. They simply restrict the packages to scan, that by default is everything.
However, for security reasons, this settings take precedence over the ones defined in the jar files.

[javier-godoy]

@mcollovati start.vaadin.com generates application.properties with vaadin.allowed-packages = com.vaadin,org.vaadin,com.example.application, which requires manual configuration in case one uses third-party add-ons with a package other that org.vaadin.* (that's why it's important to clarify that even if an add-on includes package.properties, it will not be scanned unless it's also allowed)

[mcollovati]

I wonder if it could be helpful if the vaadin-spring add on would print a warning message for the JAR rules that cannot be applied because of global allowed/blocked list.
Perhaps also Vaadin Copilot could propose changes to apply to application.properties.