feat(maven/analyze): surface property source file in analysis output

[dnegreira]

Why

Maven projects commonly declare version properties in a parent POM referenced via <parent><relativePath> rather than in the analysed pom.xml. Before this change the analyzer had no concept of where a property came from, so properties in parent POMs showed as (new) with a warning — even though the update command found and patched them correctly. Additionally, parent chain traversal during analysis had no boundary, meaning it could read POM files outside the project tree.

What

pkg/analyzer/interface.go

• Add PropertySources map[string]string to AnalysisResult, mapping each property name to the manifest file (project-relative path) that declares it.

pkg/languages/java/maven/analyzer.go

• Introduce pomFileProperties struct (POM file path + property map) so searchForProperties groups discovered properties by file rather than flattening to a single map.
• Add resolveUnknownProperties: after the filesystem walk, looks up any property still missing by following the <parent><relativePath> chain via the same resolvePropertyPomPath the updater uses — keeping analyze and update consistent.
• Add mergeProperty helper (first-definition-wins, warns on conflicting values).
• Bound findProjectRoot, resolveUnknownProperties, and searchForProperties to the analyzed project path using the existing validatePathWithinRoot helper, preventing reads outside the project tree.

pkg/languages/java/maven/updater.go / maven.go

• Add rootDir boundary parameter to resolvePropertyPomPath and dependencyPropertyUpdates. The update path was already bounded by cfg.RootDir for writes; read traversal is now bounded consistently using the same helper.

cmd/omnibump/analyze.go

• Text output shows [manifest: X] next to each property in the Property Usage section and a manifest: line above each property update in the Strategy section.

🤖 Generated with Claude Code