JAR filenames do not include the groupId
The JAR filenames exclude the groupId information, and rely on artifactId and version to be the unique key. This is not sufficient, and it is possible for there to be a collision. A simplified version of this was seen in https://gitlab.cern.ch/acc-co/devops/cbng/cbng-web/-/merge_requests/7 (where version wasn't taken into account).
By including the groupId in the filename, we can also benefit from being able to generate a lockfile from an existing environment, rather than needing to resolve the environment each time.