GROOVY-12266: Add a policy for Grape resolver roots using a plaintext…

[paulk-asert]

… protocol

Neither engine checked the scheme of a resolver root, so a @GrabResolver naming an http:// repository silently fetched artifacts that anyone on the path could read or replace, and placed that repository first in lookup order. Both engines default to an https central repository, so this only arose for explicitly configured resolvers.

Add -Dgroovy.grape.insecureProtocolPolicy, taking fail, warn or ignore and defaulting to warn, so that the resolver is reported but still added. The values mirror Maven's checksum-policy vocabulary. An unrecognised value falls back to warn rather than ignore, reported once, so that a typo cannot silently disable the check.

The check lives in the Grape facade rather than in either engine because every documented route to adding a resolver -- @GrabResolver, the grape command line tool, and Grape.addResolver -- passes through it, so the Ivy and Maven engines are covered by one implementation and behave alike.

Roots naming a loopback host are exempt under every policy since they do not cross a network, and each distinct root is reported at most once. Classification is an allow-list of known-plaintext schemes, currently http and ftp, so that encrypted transports such as s3 and gs are not reported falsely; file: roots are never insecure, as they cross no network and a network-mounted one cannot be told apart from a local one by inspecting the URI. Integrity for those repositories is checksum verification's job, which applies to every transport rather than only to remote ones.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 5.45455% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.1330%. Comparing base (5f56279) to head (7f2d92e).

Files with missing lines	Patch %	Lines
src/main/java/groovy/grape/Grape.java	5.4546%	52 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##               master      #2803        +/-   ##
==================================================
- Coverage     70.1516%   70.1330%   -0.0186%     
- Complexity      35828      35831         +3     
==================================================
  Files            1562       1562                
  Lines          132523     132578        +55     
  Branches        24379      24396        +17     
==================================================
+ Hits            92967      92981        +14     
- Misses          31140      31189        +49     
+ Partials         8416       8408         -8     

Files with missing lines	Coverage Δ
src/main/java/groovy/grape/Grape.java	18.8172% <5.4546%> (-5.6103%)	⬇️

... and 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[testlens-app]

✅ All tests passed ✅

🏷️ Commit: 7f2d92e
▶️ Tests: 110353 executed
⚪️ Checks: 31/31 completed

---

Learn more about TestLens at testlens.app.