pom.xml contains

However, some class files are not only setters and getters but also have code that goes beyond.

To get complete code analysis by Sonar the sonar.exclusions should be removed from pom.xml.

https://dev.folio.org/guides/code-analysis/#rule-customization explains what to use instead:

Use @SuppressWarnings with the list of specific warnings to suppress. That way we get all other warnings about potential issues in the code, including security warnings.