Deps: Bump to Resolver 2.0.21

[cstamas]

And add more validation to MavenValidator.

[gnodet]

Clean dependency bump adapting Maven 4.x (master) to the upcoming Resolver 2.0.21 API. Well-structured changes across 7 files.

What's good:

• The Optional<Repository> return type in InternalSession.getRepository() properly handles the new ArtifactResult.NO_REPOSITORY sentinel — much cleaner than exposing the sentinel to callers
• Good Javadoc on the getRepository() method explaining the sentinel semantics and when Optional.empty() is returned
• Additional validation via PathUtils.validateArtifactComponents() / validateMetadataComponents() in MavenValidator hardens against path traversal — nice security improvement
• Both RepositorySystemSupplier implementations (main + testing stubs) correctly updated with the new TransporterProvider parameter
• All CI passing across all platforms and JDK versions

Minor note:

• In DefaultArtifactResolver, the mappedExceptions collector uses .orElse(null) which could produce a null key in the map if NO_REPOSITORY appears in exception mappings. This is fine with HashMap semantics but worth keeping in mind if the map type ever changes.

LGTM — companion to #12504 (maven-3.10.x), this one cleanly adapts the master branch.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet