Scope server credentials and validate legacy relocation coordinates

[gnodet]

Summary

Forward-port of #12954 from maven-3.10.x to maven-4.0.x, adapting all three fixes for the 4.0.x module structure and API differences:

• OriginBoundAuthenticationSelector (new file in impl/maven-core): scopes server credentials to the declared origins (protocol, host, port) of repositories and mirrors configured in settings, preventing credential leakage to unrelated repositories. Supports three modes via maven.repository.credentialScope: origin (default), strict, and id (legacy).
• Relocation coordinate validation (compat/maven-compat MavenMetadataSource): validates relocation groupId, artifactId, and version components before applying them, rejecting path traversal characters (/, \, ..) and control characters.
• Exact server ID matching (compat/maven-compat DefaultWagonManager): uses equals instead of equalsIgnoreCase for server ID matching, consistent with LegacyRepositorySystem.injectAuthentication and the resolver's authentication selector.

Adaptations for 4.0.x

• Module paths: maven-compat/ -> compat/maven-compat/, maven-core/ -> impl/maven-core/
• OriginBoundAuthenticationSelector uses org.slf4j.Logger (4.0.x) instead of org.codehaus.plexus.logging.Logger (3.10.x)
• Credential scope property read from mergedProps (4.0.x property flow) instead of ConfigUtils.getString(configProps, ...) (3.10.x)
• MavenMetadataSourceRelocationTest uses constructor injection (4.0.x) instead of reflection-based field injection (3.10.x)

Test plan

• mvn verify -pl impl/maven-core -- 602 tests pass, 0 failures
• mvn verify -pl compat/maven-compat -- 156 tests pass, 0 failures
• New OriginBoundAuthenticationSelectorTest covers: declared origin matching, origin scoping, undeclared ID legacy behavior, strict mode refusal, ID scope passthrough, unknown scope rejection, origin normalization
• New MavenMetadataSourceRelocationTest covers: invalid artifactId rejection, well-formed relocation application

🤖 Generated with Claude Code

[gnodet]

Clean forward-port of #12954 from maven-3.10.x to maven-4.0.x. All adaptations are correctly applied:

• Module paths: impl/maven-core/ and compat/maven-compat/ (4.0.x structure)
• Logging: org.slf4j.Logger instead of Plexus Logger
• Property flow: mergedProps.getOrDefault(...) instead of ConfigUtils.getString(configProps, ...)
• Test injection: Constructor injection instead of reflection-based field injection

CI passes on all 24 checks (ubuntu, macos, windows; JDK 17, 21, 25). One minor style nit noted inline (carried over from the 3.10.x version).

Observations (informational):

1. The MAVEN_REPOSITORY_CREDENTIAL_SCOPE constant is defined on DefaultRepositorySystemSessionFactory rather than in org.apache.maven.api.Constants where most other user-facing properties live. Could be moved in a follow-up for consistency.

🔀 Backport / Forward-port Status

Branch	Status
maven-3.10.x	✅ #12954 (merged)
maven-4.0.x	🔄 This PR
maven-3.9.x	⚠️ Still has equalsIgnoreCase bug and lacks credential scoping + relocation validation
master	⚠️ Still has equalsIgnoreCase in compat/maven-compat/.../DefaultWagonManager.java and lacks credential scoping

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet

[gnodet]

Style nit (also noted in the 3.10.x review of #12954): assertEquals(true, ...) is less readable than assertTrue(...) for boolean assertions.

Suggested change

	assertEquals(true, exception.getMessage().contains("artifactId"));
	assertTrue(exception.getMessage().contains("a/b"));
	assertTrue(exception.getMessage().contains("artifactId"));