Use a dedicated Maven server id for Central Portal publishing - #68

GitHub Actions' hosted Ubuntu 24.04 runners
[now ship Maven 3.10](https://github.com/actions/runner-images/blob/7e7dc1bcc0ef464e5e315a2b4c33609590c6cffe/images/ubuntu/Ubuntu2404-Readme.md#project-management),
which [offers the credentials of a `<server>` in `settings.xml` only to
the repository origins associated with its id](https://maven.apache.org/docs/3.10.0/release-notes.html#Repository_credentials_are_scoped)
(an origin is a scheme, host and port). The setup-java action
generates this `settings.xml` from its `server-id` input.

The id `central` is also the id of Maven's built-in Central repository
(https://repo.maven.apache.org, where dependencies are downloaded from),
so Maven did not send our Central Portal user token (the
`CENTRAL_SONATYPE_*` secrets) to the Sonatype Central Portal
(https://central.sonatype.com), where we publish, and the snapshot
deploy in CI failed:

```
[WARNING] Not using credentials of server 'central' for repository https://central.sonatype.com/repository/maven-snapshots/: the origins declared for this id are [https://repo.maven.apache.org]. Add 'https://central.sonatype.com' to <repositoryOrigins> of that server in settings if these credentials belong there, or set maven.repository.credentialScope=id to restore legacy id-only credential matching.
[ERROR] Failed to execute goal org.sonatype.central:central-publishing-maven-plugin:0.8.0:publish (injected-central-publishing) on project kaitai-struct-runtime: Failed to deploy artifacts: Could not transfer artifact io.kaitai:kaitai-struct-runtime:jar:0.12-20261015.145648-9 from/to central (https://central.sonatype.com/repository/maven-snapshots/): HTTP Status: 401 -> [Help 1]
```

actions/setup-java#1284 describes the same
failure.

Unlike `central`, the new id `sonatype-central` is not the id of any
repository, so Maven ties no origin to it and uses its credentials for
the Central Portal.
[According to Maven's source](https://github.com/apache/maven/blob/c43a36b8d67be7e0805a411bc0898af1a51f5472/maven-core/src/main/java/org/apache/maven/internal/aether/OriginBoundAuthenticationSelector.java#L159-L169),
Maven should then log a different, non-blocking warning instead of the
one above: "Using credentials of server 'sonatype-central' ... although
no repository or mirror with this id is declared ... and the server
declares no `<repositoryOrigins>`".

Two alternatives were rejected:

- Adding https://central.sonatype.com to the `<repositoryOrigins>` of
  the `central` server: [declared origins are added to the discovered
  ones](apache/maven#13275),
  so Maven would still offer the token to repo.maven.apache.org (which
  never needs it), as Maven 3.9 did by matching credentials by id
  alone.
- Restoring the id-only matching with
  `-Dmaven.repository.credentialScope=id`: it would turn off the new
  origin scoping entirely.

The new warning can be silenced by declaring the origin as
`sonatype-central:https://central.sonatype.com` in the
`mvn-server-repository-origins` input of
[setup-java v6.1.0](https://github.com/actions/setup-java/releases/tag/v6.1.0);
this repository still uses setup-java v5.6.0, which lacks that input.

Release deploys will also need central-publishing-maven-plugin 0.12.0
or newer, the first version that
[supports Maven 3.10](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/blob/15c4bb23cb74f6f65357037278712c9c4620ab25/README.md#compatibility).
Older versions leave the extra files that Maven 3.10 writes into the
staging directory (`maven-metadata-local.xml`, `_remote.repositories`)
in the release bundle, [which Central rejects](https://central.sonatype.org/publish/publish-portal-maven/#0120-13-oct-2026)
(sonatype-nexus-community/central-publishing-maven-plugin#1).
This repository still uses 0.8.0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>