datasource: stop applying settings.xml auth to added Maven registries

[1seal]

Summary

• keep settings.xml authentication for the default or user-selected Maven registry
• stop applying those credentials to additional registries discovered from scanned pom.xml content
• add regression coverage for both the trusted default-registry path and the untrusted added-registry path

Why

settings.xml credentials are keyed only by Maven server ID. When a scanned pom.xml adds a registry with an attacker-controlled id and url, the current client can pair that ID with local credentials and forward them after a 401 challenge.

Additional registries discovered from scanned project content are untrusted input, so they should not inherit settings.xml authentication by default.

Refs google/osv-scanner#2672

Testing

• go test ./clients/datasource -run 'Test(DefaultRegistryUsesSettingsAuth|TestAddedRegistryDoesNotUseSettingsAuth)'
• go test ./clients/resolution/... ./common/... ./guidedremediation/...

[another-rex]

Thank you!

I'm not sure this is a behavior we want though, we are trying to match the ecosystem tooling behavior, so users shouldn't be running this extractor on untrusted input. Adding this feature might just be giving users false confidence on running on untrusted pom.xml files.

On the other hand we might want something like this for a hardened scalibr scanning mode while still enabling these features. @cuixq is probably best to review this as they have the most context, though they are currently OOO for a few weeks, so the review will be a bit delayed.