code: private boolean vulnerabilitiesMatch(Dependency dependency1, Dependency dependency2) {
          final Set<Vulnerability> one = dependency1.getVulnerabilities();
          final Set<Vulnerability> two = dependency2.getVulnerabilities();
          return one != null && two != null
                  && one.size() == two.size()
                  && one.containsAll(two);
      }
docs: Returns true if the two dependencies have the same vulnerabilities.
  
  @param dependency1 a dependency2 to compare
  @param dependency2 a dependency2 to compare
  @return true if the two dependencies have the same vulnerabilities