feat: support Maven server credential origins

[YunaBraska]

Why

Maven 3.10 scopes a settings.xml server credential to repository origins. setup-java can generate Maven server credentials, but cannot declare the corresponding <repositoryOrigins>. When a publisher resolves a repository dynamically, such as Central Publishing using https://central.sonatype.com, Maven intentionally withholds the configured credential and deployment fails with HTTP 401.

This is the behaviour introduced by Maven 3.10: release notes, settings reference, and implementation change.

Consumers currently have to patch the settings.xml generated by this action after every setup step.

What

• Add mvn-server-repository-origins, a multiline server-id:repository-origin input.
• Generate <repositoryOrigins> within the matching Maven server.
• Normalize origins and reject malformed values, paths, credentials, query strings, fragments, and unknown server IDs.
• Document Central Publishing and multi-server use.

Example:

with:
  server-id: central
  server-username-env-var: CENTRAL_USER
  server-password-env-var: CENTRAL_PASS
  mvn-server-repository-origins: |
    central:https://central.sonatype.com

Verification

npm run check

• 45 test suites passed
• 1,523 tests passed
• format, lint, bundle build, and coverage all passed

[Copilot]

Copilot review overview

🟡 Changes recommended

Origin parsing accepts malformed values and can normalize non-HTTP ports incompatibly with Maven.

Review effort: Balanced
Findings: 2

Open (2)

• Validate raw repository URL syntax before WHATWG normalization · New
• Preserve explicit non-HTTP(S) ports in Maven origin matching · New

What changed in this PR

Adds Maven 3.10 repository-origin scoping for generated server credentials.

Changes:

• Adds and validates mvn-server-repository-origins.
• Emits <repositoryOrigins> in Maven settings.
• Updates tests, documentation, and distribution bundles.

File	Description
src/​constants.ts	Defines the new input.
src/​auth.ts	Parses origins and generates XML.
README.md	Documents the input.
docs/​advanced-usage.md	Adds multi-server examples.
action.yml	Exposes the action input.
__tests__/​auth.test.ts	Tests parsing and generation.
dist/​setup/​index.js	Updates the setup bundle.
dist/​setup/​81.index.js	Bundles authentication logic.
dist/​cleanup/​index.js	Updates bundled constants.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.