Fix fork Maven config: set updatePolicy=never to prevent 401 on cached artifacts (#1389)

## Summary
Even with artifacts in the local cache (~350MB restored successfully),
Maven checks the remote repository for POM metadata updates. For forked
PRs the JFrog mirror has no credentials, so these update checks get 401
errors — causing `maven-toolchains-plugin:3.2.0` resolution to fail even
though the JAR is cached.

Fix: for forked PRs only, configure repository and pluginRepository with
`updatePolicy=never` in an active profile. This tells Maven to use
cached artifacts without contacting the remote for updates. The non-fork
path (JFrog OIDC with full credentials) is unchanged.

## Test plan
- [ ] Re-run PR #1371 CI after merge — toolchains plugin should resolve
from cache without 401

NO_CHANGELOG=true

This pull request was AI-assisted by Isaac.

---------

Signed-off-by: Gopal Lal <gopal.lal@databricks.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: gopalldb

.github/actions/setup-maven/action.yml

@@ -35,10 +35,33 @@ runs:
               <url>https://databricks.jfrog.io/artifactory/db-maven/</url>
             </mirror>
           </mirrors>
-          <!-- No <servers> block: forked PRs use cached dependencies only.
-               Any cache miss will produce a clear HTTP 401 error indicating
-               the dependency is not in cache. Ask a maintainer to run the
-               "Warm Maven Dependency Cache" workflow with your PR number. -->
+          <!-- No <servers> block: forked PRs use cached dependencies only. -->
+          <!-- updatePolicy=never prevents Maven from checking the remote for
+               updates, avoiding 401 errors when artifacts are already cached. -->
+          <profiles>
+            <profile>
+              <id>cache-only</id>
+              <repositories>
+                <repository>
+                  <id>jfrog-central</id>
+                  <url>https://databricks.jfrog.io/artifactory/db-maven/</url>
+                  <releases><updatePolicy>never</updatePolicy></releases>
+                  <snapshots><updatePolicy>never</updatePolicy></snapshots>
+                </repository>
+              </repositories>
+              <pluginRepositories>
+                <pluginRepository>
+                  <id>jfrog-central</id>
+                  <url>https://databricks.jfrog.io/artifactory/db-maven/</url>
+                  <releases><updatePolicy>never</updatePolicy></releases>
+                  <snapshots><updatePolicy>never</updatePolicy></snapshots>
+                </pluginRepository>
+              </pluginRepositories>
+            </profile>
+          </profiles>
+          <activeProfiles>
+            <activeProfile>cache-only</activeProfile>
+          </activeProfiles>
         </settings>
         SETTINGS_EOF