add Maven credential metadata to the URLs it searches for POM files

[jakecoffman]

Currently Dependabot uses any repository or pluginRepository URL it finds in the POM to search for parent POM files. However, there is no reason a child POM needs to have any repositories defined at all. It's fairly common for private/custom registries to only be defined in the parent which is published to the registry.

The reason why this works locally for Maven users is they often have a settings.xml which defines what registry to use, but that file isn't typically checked in to git.

Dependabot users commonly try to put the registry in dependabot.yml as a hint to where it can find the parent POM.

This PR takes that hint and puts Maven registries defined in dependabot.yml at the front of the list of registries to check.

[jakecoffman]

This should fix #5523

[honeyankit]

This looks good to me.

[mctofu]

I had been thinking we'd only do this for creds with replaces-base: true. I can see now that you might want this but still allow a public registry though. Is there any potential for breaking existing jobs if we start to automatically move the registry sources to the front?

Alternatives might be:

1. Introducing a new "global" key on the registry to indicate it comes from a global configuration not checked into the repo so we should insert it
2. Use replaces-base which would also remove automatic usage of the default registry but allow the default registry to added back via inclusion in dependabot.yml registries.

But if it doesn't seem likely this would break anything we could try this out first.

[jakecoffman]

My thought was replaces-base would remove the default registry if it is true in any of the maven creds. I was going to follow this up by adding that in the next bite-sized PR.

This approach does allow fallback to Maven Central. For users of GitHub Registry that's probably what they want. It's also possible GHR users would want to check Central first to avoid 404ing first. If we drop the username and password requirement, then they have complete control of the order by specifying in dependabot.yml.