In D106100, we started guarding against spurious dependencies on modules that ended up being textual includes and thus didn't have any AST file associated. That patch accounted only for direct dependencies. There's a way how to get spurious dependencies for modules that are transitive. This patch guards against that scenario and adds a test case.
(Note that since D142167, we don't allow @import FW_Private with -fmodule-name=FW anymore. However, that check lives in sema, which the scanner doesn't run. Being defensive in this patch therefore still makes sense.)
rdar://104324602