How do I prevent including JARs in WEB-INF/lib? I need a "compile only" scope!

The scope you should use for this is provided. This indicates to Maven that the dependency will be provided at run time by its container or the JDK, for example.

Dependencies with this scope will not be passed on transitively, nor will they be bundled in an package such as a WAR, or included in the runtime classpath.