feat(java): support user-defined Maven mirrors in trivy.yaml

[DmitriyLewen]

Description

Maven Central rate limiting can return HTTP 429 while Trivy resolves pom.xml dependencies during a scan.
Trivy already honors <mirrors> from Maven settings.xml, but users should also be able to configure mirrors directly in trivy.yaml — without modifying the shared Maven build settings (for example, in CI).

The proposal is a scan.maven.mirrors map in trivy.yaml that maps a source repository URL to an ordered list of mirror URLs.
Trivy tries the mirrors in order and falls back to the next one when a mirror cannot provide the requested artifact.

scan:
  maven:
    mirrors:
      https://repo.maven.apache.org/maven2/:
        - https://my-internal-mirror/maven2/
        - https://backup-mirror/maven2/

Details

• Applies to Maven dependency resolution in filesystem and repository scans; it is not applied to image or VM scanning.
• trivy.yaml mirrors are applied after settings.xml/pom.xml resolution, so an existing mapping such as repo1 -> repo2 is preserved, and repo2 can then be mapped to repo3 by trivy.yaml.
• Mirror URLs are validated at startup (fail-fast).
• The GCS mirror is not enabled by default.

Acceptance criteria

• Users can configure one or more Maven mirrors in trivy.yaml.
• Trivy falls back to the next configured mirror when the previous one cannot provide an artifact.
• Existing settings.xml/pom.xml repository configuration is not unexpectedly overridden.
• Invalid mirror URLs are rejected before the scan starts.
• Unit tests and documentation cover the configuration, fallback behavior, URL validation, and precedence rules.

References

• bug(pom): 429 from remote Maven repository is silently swallowed, producing incomplete scan results #10691