Warn when unpinned recipe artifacts resolve from Maven Central

[timtebeek]

• Fixes Warn when recipe artifacts resolve from Maven Central #1180
• Maven counterpart to Warn when recipe artifacts resolve from Maven Central rewrite-gradle-plugin#459

What

When rewrite.recipeArtifactCoordinates asks for an OpenRewrite/Moderne recipe artifact with a dynamic version (LATEST, RELEASE, [6.0,7.0), …) and it is served by the real Maven Central, the plugin logs a warning pointing at the Code Genome Project:

[WARNING] These recipe artifacts resolve from Maven Central, which no longer receives new recipe releases:
[WARNING]     org.openrewrite.recipe:rewrite-testing-frameworks:LATEST resolved to 3.42.1
[WARNING] Newer recipe versions are published to the Code Genome Project; configure it in your repositories to stop resolving stale recipes.
[WARNING] See https://codegenomeproject.org/token for credentials and repository configuration.

Informational only — resolution is untouched and the build still succeeds.

Acceptance criteria

Criterion	How it's met
Warn when recipe artifacts resolve from Maven Central and a newer version is expected on CGP	A dynamic version actually served by Maven Central is exactly the "silently stale" case
Warning links to the docs page for getting CGP credentials	Links to https://codegenomeproject.org/token
No warning through a configured repository, including an internal mirror	Only repo.maven.apache.org / repo1.maven.org / repo2.maven.org count as Maven Central. Maven substitutes a mirror's id and URL into the project's repositories before resolution, so a mirror is reported under its own URL
No warning on explicitly pinned versions	Only dynamic version selectors are considered

Alignment with the Gradle plugin

Shared with openrewrite/rewrite-gradle-plugin#459: the CodeGenomeProjectWarning class name, the warningFor(..) entry point returning @Nullable String, the CREDENTIALS_DOCS constant, the exact message text, the Maven Central host set, and the org.openrewrite/io.moderne group check. CodeGenomeProjectWarningTest and StaleRecipeArtifactIT mirror the Gradle plugin's CodeGenomeProjectWarningTest and StaleRecipeArtifactTest case for case.

Three deliberate divergences:

1. Detection uses the repository the artifact actually came from, not the declared repository set. The Gradle PR notes that Gradle's ResolutionResult exposes no repository origin, so it falls back to inspecting declared repositories. Maven's ArtifactResult.getRepository() reports the serving repository — and, thanks to the enhanced local repository manager's _remote.repositories tracking, still does so for artifacts already in the local cache. That's strictly more precise, so I kept it.
2. No "CGP is configured, therefore stay quiet" suppression. In Gradle that rule exists because a declared CGP repository makes the origin ambiguous. Maven has no such ambiguity, and the case it would suppress — CGP declared but Central still served the artifact, e.g. because Central is checked first or credentials are wrong — is a genuine stale-recipe situation worth reporting.
3. The listed coordinate carries the version it resolved to (…:LATEST resolved to 3.42.1). Maven knows this at warning time; Gradle does not.

The dynamic-version selectors necessarily differ, since each matches its own build tool's syntax: LATEST/RELEASE/[/( here versus latest.*/+/ranges in Gradle.

Design notes / open questions

• The issue suggested keying off "the last version published to Maven Central". I didn't hardcode a per-artifact version map — it needs upkeep on every artifact, and "dynamic version + served by Central" already identifies the same population without going stale itself. Same call as the Gradle PR; happy to switch if the known-final-version list is preferable.
• Scope is rewrite.recipeArtifactCoordinates, which is what this plugin resolves itself. Recipe modules declared as plugin <dependencies> are resolved by Maven core before the mojo runs and are always pinned, so they fall outside both the hook point and the acceptance criteria. This matches the Gradle PR leaving the plugin's own bundled dependencies unchecked.
• ArtifactResolver's constructor gained a Log parameter. Both call sites are in this repo.
• Message wording and the docs URL want a review, and should land identically in both PRs.

Testing

• CodeGenomeProjectWarningTest — 12 cases over the detection rule (dynamic selectors, Moderne groups, pinned versions, unrelated groups, internal mirror, CGP-served, transitive dependencies, non-remote repository).
• StaleRecipeArtifactIT — itf integration tests asserting the warning appears on rewrite:discover for a LATEST coordinate and stays quiet for a pinned one. Both pass locally (~16s).
• Also verified by hand against a scratch project with the plugin installed locally, before the ITs existed: the jar was already in the local repository and the origin was still correctly reported as Central, so the warning is not limited to cold caches. Separately confirmed that with a <mirror> of central configured, Maven reports the project's remote repositories as the mirror's id/URL, so the host check cannot match.