Publish solely to the Code Genome Project, dropping Maven Central

[timtebeek]

• Follow-up to Forward CGP artifact repository credentials for dependency resolution #461, which forwarded CGP_ARTIFACTS_MAVEN_* so the build could resolve org.openrewrite/io.moderne from the Code Genome Project. This moves the publication side over too.

The only Maven publication this repo ever had was the CI snapshot upload to Sonatype — org.openrewrite:plugin has never existed on Maven Central proper (repo1.maven.org/.../org/openrewrite/plugin/ is a 404; only central.sonatype.com/repository/maven-snapshots has it). So "drop Maven Central" here means: drop the Sonatype snapshot upload and the nexus-publish plumbing behind it. Releases keep going to the Gradle Plugin Portal via publishPlugins, which is untouched.

• build.gradle.kts: drop io.github.gradle-nexus.publish-plugin and the nexusPublishing block.
• plugin/build.gradle.kts: register the cgp S3 repository, mirroring RewriteCgpPublishPlugin from rewrite-build-gradle-plugin (region-qualified host so Gradle's S3 transport doesn't default to us-east-1; AwsCredentials from the environment; optional session token). Registered only when both AWS credentials are non-empty, so ./gradlew publish stays a no-op for anyone without them — same guard shape as the resolution repo added in Forward CGP artifact repository credentials for dependency resolution #461.
• .github/workflows/ci.yml: publish-snapshots now runs :plugin:publish with CGP_AWS_ACCESS_KEY_ID/CGP_AWS_SECRET_ACCESS_KEY (the secret names gh-automation callers already use) instead of publishPluginMavenPublicationToSonatypeRepository with the Sonatype and OSSRH signing secrets. Those signing secrets were inert anyway — no signing plugin is applied in this repo.
• README.md: snapshots are no longer anonymously consumable, so the snapshot section now points at artifacts.codegenomeproject.org/maven with credentials.

One deliberate behavior change: the old command published only pluginMaven, whereas :plugin:publish also uploads the rewritePluginMarkerMaven marker, so snapshot consumers can use a plain plugins {} block. The useModule resolution strategy in the README still works, so it stays for now.

Verified locally: with fake AWS credentials, :plugin:tasks --group=publishing lists publishPluginMavenPublicationToCgpRepository and no Sonatype tasks; with the credentials unset, no cgp tasks appear at all. ./gradlew snapshot :plugin:publish -x test -x publishPlugins --dry-run produces the expected task graph, and actionlint passes on ci.yml. No upload was actually attempted, so the S3 write path itself rests on matching the convention plugin rather than on an observed run.