Match Apache Maven's anonymous-first authentication for POM and JAR downloads

[Jammy-Louie]

Summary

• Follow-up to Fall back to anonymous JAR download on 4xx when Maven credentials are rejected #8158. This brings both download paths onto Apache Maven Resolver's model: request anonymously first, send credentials only when the server challenges with a 4xx, and cache per host which repositories required auth so later requests authenticate preemptively without repeating the anonymous probe.

1. Anonymous-first requests. MavenPomDownloader (reachability probes, jar-existence HEAD, and body/metadata GETs) and MavenArtifactDownloader now request without credentials first and retry with credentials on a credential-rejecting 4xx. This also stops sending credentials to repositories that serve anonymously.
2. Per-host auth cache. A session-scoped host:port set on the ExecutionContext records which endpoints required authentication, mirroring Maven Resolver's BasicAuthCache (and the existing getUnreachableEndpoints pattern). Once a host is known to require auth, both downloaders authenticate preemptively. MavenArtifactDownloader gains additive ExecutionContext constructors, and JavaRewriteRpc passes its context through so the jar phase shares the cache warmed during POM resolution.

The first request to a private host costs one extra anonymous 401 probe before authenticating; the cache limits this to once per host per session, the same one-time cost Maven pays.

Test plan

• MavenPomDownloaderTest#doesNotSendCredentialsWhenRepositoryServesAnonymously
• MavenPomDownloaderTest#authenticatesPreemptivelyAfterCredentialsRequired
• MavenArtifactDownloaderTest#retriesWithCredentialsWhenAnonymousReturns401, #retriesWithHttpHeaderAuthWhenAnonymousReturns401
• MavenArtifactDownloaderTest#doesNotFallBackToAnonymousOnTransientClientError
• MavenArtifactDownloaderTest#authenticatesPreemptivelyAfterFirstChallengeForSameHost
• Full rewrite-maven module test suite