Maven resolution: cool down after HTTP 429, dedupe repositories by URI, and let a silent mirror keep the mirrored repository's policy

[jkschneider]

• Closes Maven resolution: cool down endpoints after HTTP 429, dedupe repositories by URI, and let a silent mirror inherit the mirrored repository's policy #8682. One commit per section of the issue; none changes behavior against a healthy repository.

1. An endpoint that answers HTTP 429 is not asked again for 60s

A 429 is transient, so it is deliberately never negative-cached, but nothing remembered it either: every later metadata or POM lookup re-asked the throttled host, and a failed metadata request was followed by a second request for the directory listing.

• MavenExecutionContextView.getThrottledEndpoints(): a host:port -> skip-until map, sibling to getUnreachableEndpoints().
• MavenPomDownloader.sendRequest records a 429 with a 60s cooldown; HttpSenderResponseException.isThrottled() added.
• distinctNormalizedRepositories skips a cooling-down repository and reports it through ResolutionEventListener.repositoryAccessFailedPreviously; deriveMetadata does not follow a 429 with the listing request.

Retry-After is not honored yet, as the issue anticipated.

2. Repositories are deduplicated by URI, not by id

distinctNormalizedRepositories deduped on the post-mirror id, so two entries with different ids and the same URL cost a request each per lookup. The seen set is now keyed on the URI that would be asked (trailing slash trimmed, scheme/host case-folded); first occurrence wins so order and credentials are preserved. The "central" id check is untouched, since that is Maven's override rule for the implicit Central.

3. A mirror without a policy of its own keeps the mirrored repository's

MavenRepositoryMirror.apply widened the mirrored repository to releases=true, snapshots=true unless the mirror said false. Maven's DefaultMirrorSelector.getMirror copies the mirrored repository's policies onto the mirror instead, so mirroring Central through a <mirror> no longer turns it into a snapshot-accepting repository. Explicit values on the mirror still override.

Sections 2 and 3 are not quite independent

When several repositories collapse onto one mirror, Maven unions their policies (DefaultRemoteRepositoryManager.mergeMirrors); the old widening was accidentally approximating that. With per-repository policy on the mirror, "first occurrence wins" would have kept releases-only mirrored-Central and dropped the snapshot-accepting mirrored repository. download already passes the version into the iterator, so the first accepting occurrence wins — the union for a single lookup — but downloadMetadata filtered by version only after deduplication and would have stopped resolving -SNAPSHOT metadata through a * mirror. It now passes the version through like download does, and its redundant in-loop check is gone. mirrorKeepsThePolicyOfEachRepositoryItMirrors covers exactly this case.

Verification

• Full :rewrite-maven:test: 1515 tests, 0 failures.
• rewrite-gradle tests that go through mirrors (EffectiveGradleRepositoriesTest, FindRepositoryOrderTest, ChangeDependencyConcurrencyTest, UseJavaExtensionBlockTest): green.