Output, transport and consumer POM robustness fixes

[slachiewicz]

Robustness fixes across the CLI, transport and consumer POM.

• Transfer listener output. Control characters in transfer messages are escaped so they render literally rather than being interpreted by the terminal. Tab and newline are preserved.
• Transport base URI. Relative locations resolve against a slash-terminated base, so a relative reference cannot resolve outside it.
• Mirror matching. isExternalRepo/isExternalHttpRepo parsed with java.net.URL, which throws on dav:, dav:http: and dav+http: — leaving those branches unreachable — and returned false on any parse failure, so an unparseable URL matched no external:* mirror. Parsing is now textual and an unparseable URL is treated as external.
• Settings decryption messages. Decryption failure messages identify the server or profile property concerned rather than including the encrypted value.
• Consumer POM repositories. The consumer POM now publishes only repositories the project's own POM declares; those present only via a parent POM or an active settings.xml profile are dropped, with a warning naming each. maven.consumer.pom.sanitizeRepositories=false restores the previous behaviour. This changes a published artifact format — see the note below.
• mvnup resolution. mvnup reused hardcoded repositories and forced user.home, so a real settings.xml was never read. It now uses the settings the CLI already loaded and the configured local repository. Where the standalone resolver cannot honour the configuration — offline mode, a redirecting mirror, an active proxy — it is given no remote repositories and the affected strategies skip their remote work with a warning.

Release note for the consumer POM change: a downstream consumer relying on inheriting a repository declaration that existed only in a parent POM or the publisher's settings will need to declare that repository itself.

Each change is a separate commit.

---

Draft while related code paths are reviewed — the same guard may be needed in sibling implementations of these interfaces, and I would rather establish that before asking for review time.

[gnodet]

✅ Solid PR — Two Minor Style Observations

Well-structured multi-topic robustness PR with good test coverage across all changes: control character sanitization, fail-closed mirror matching, transport path traversal prevention, settings decryption message improvement, consumer POM repository restriction, and mvnup settings resolution. This is the master sibling of #12946 (maven-4.0.x), which was already approved.

Minor observations (non-blocking):

1. Style (MavenITgh10210SettingsXmlDecryptTest.java:77): assertTrue(!log.contains(...)) → assertFalse(log.contains(...)) for readability and better assertion failure messages.

2. Logging level (DefaultConsumerPomBuilder.java:603): The "publishing repository" message for retained repositories is logged at WARN. Unlike the dropped-repository message (which is genuinely a warning about a behavioral change), this message is purely informational — it confirms that a repository the project declared is being kept. Using WARN here will be noisy for projects declaring custom repositories, especially in CI pipelines that fail-on-warn. INFO or DEBUG would be more appropriate.

📋 PR Metadata

Aspect	Current	Suggested
Milestone	(none)	4.1.0

🔀 Backport Status

• ✅ maven-4.0.x — #12946 (OPEN, reviewed & approved)

---

_{🤖 This review was generated by ForgeBot.}