[simonchrz]

Maven part of #132, along the lines agreed there.

With cooldown on:

• A version's publish time is the Last-Modified of its .pom, stored in the versions table once per version, as npm and Go do. On Maven Central it is the deploy time. When the .pom or Gradle .module itself is downloaded, which clients do before a version's other files, the time comes from that response, so a build of pinned versions costs no extra requests. Otherwise it is read with a HEAD request that names the proxy in its User-Agent. A .pom or .module refused this way is still cached, so it counts toward max_size before the version leaves cooldown. Only a 2xx response is used. A missing .pom lets the version through; any other failure gives 502 instead of letting it through, or 503 with the upstream's Retry-After when Central rate-limits the proxy.
• To keep requests to Central down, filtering maven-metadata.xml only checks versions that can still be in cooldown. If <lastUpdated> is older than the window, nothing is checked. Otherwise the proxy walks the list from the end and stops at the first version that is old enough, so usually one or two HEAD requests per artifact, once.
• Versions in cooldown are left out of maven-metadata.xml. <latest> and <release> move to the last versions left, and the metadata's .md5/.sha1/.sha256/.sha512 are computed from what is served. The document is edited in place, so the rest stays as upstream sent it, and served like other ecosystems' rewritten metadata, with gzip and the stale warning.
• Any file of a version in cooldown gets 403, as for a version on the denylist.
• Repositories under upstream.maven_repositories store their times under a repository_url qualifier, so they don't share times with Central.
• SNAPSHOT versions are left alone.

The caveats are in docs/configuration.md next to the Go one: Nexus/Artifactory may report when they cached the file; on Google's mirror Last-Modified is when the file reached the bucket (the proxy doesn't read x-goog-meta-last-modified); and since Central lists versions in version order, a backport to an older line can stay listed while in cooldown, though its files are refused.

Checked against Maven Central with a 10-day cooldown:

• Metadata for jackson-databind: 2.22.4 (17 October) was left out, <latest> and <release> became 2.22.3, the served .sha1 matched, and the 2.22.4 .pom got 403. That took two HEAD requests; a second metadata request took none.
• Maven 3.9 in a container, through the proxy: a project pinned to jackson-databind 2.22.4 fails with 403 on the .pom; 2.22.3 resolves.

A first version read each pinned version's time with a HEAD before its download. A fresh Maven build through it sent about 150 requests to Central in five seconds and got a 429 with a 30-minute Retry-After; reading the time from the .pom download removes those HEADs. I couldn't repeat the full build after that without risking another block, so the version-range and plugin cases are covered by the unit tests only.