Warn when recipe artifacts resolve from Maven Central

[timtebeek]

• Fixes Warn when recipe artifacts resolve from Maven Central #458

What

When the rewrite configuration asks for an OpenRewrite/Moderne recipe artifact with a dynamic version (latest.release, 1.+, [1.0,2.0), …) and the only repository that can serve it is the real Maven Central, the plugin now logs a warning pointing at the Code Genome Project:

These recipe artifacts resolve from Maven Central, which no longer receives new recipe releases:
    org.openrewrite.recipe:rewrite-testing-frameworks:latest.release
Newer recipe versions are published to the Code Genome Project; configure it in your repositories to stop resolving stale recipes.
See https://codegenomeproject.org/token for credentials and repository configuration.

Informational only — resolution is untouched and the build still succeeds.

Acceptance criteria

Criterion	How it's met
Warn when recipe artifacts resolve from Maven Central and a newer version is expected on CGP	A dynamic version served only by Maven Central is exactly the "silently stale" case
Warning links to the docs page for getting CGP credentials	Links to https://codegenomeproject.org/token
No warning through a configured repository, including an internal mirror	Only repo.maven.apache.org / repo1.maven.org / repo2.maven.org count as Maven Central; a mirror URL doesn't. A repository whose host contains codegenome suppresses the warning outright
No warning on explicitly pinned versions	Only dynamic version selectors are considered

Design notes / open questions

• Detection is by declared repository, not by the repository an artifact actually came from. Gradle's public ResolutionResult API exposes no repository origin (ResolvedComponentResult has no getRepositoryName()), and the plugin supports Gradle back to 4.10, so reaching into internals wasn't attractive. Declared-repository inspection is a heuristic, but it's the conservative direction: an unknown repository set (e.g. repositories declared in settings.gradle via dependencyResolutionManagement, where project.getRepositories() is empty) produces no warning rather than a false one.
• The issue suggested keying off "the last version published to Maven Central". I didn't hardcode a per-artifact version map — it needs upkeep on every artifact, and "dynamic version + Central-only" already identifies the same population without going stale itself. Happy to switch if the known-final-version list is preferable.
• The plugin's own bundled rewrite-core et al. are not checked — those are pinned by the plugin and move with a plugin upgrade. Only user-declared rewrite configuration dependencies are considered "recipe artifacts". Let me know if the bundled ones should warn too.
• Message wording and the docs URL want a review. https://codegenomeproject.org/token is the sign-in/build-configuration page; if there's a dedicated docs page for obtaining credentials, that's probably the better link.

Testing

• CodeGenomeProjectWarningTest — unit tests over the detection rule (dynamic selectors, Moderne groups, pinned versions, unrelated groups, internal mirror, CGP configured, no visible repositories).
• StaleRecipeArtifactTest — TestKit functional tests asserting the warning shows up on rewriteDiscover for a latest.release recipe and stays quiet for a pinned one.