Populate Version#integrity for maven via .jar.sha1 sidecar

[Marc-cn]

Maven Central publishes a .sha1 sidecar next to each artifact; fetch
-.jar.sha1 and map it to integrity as sha1-.
Returns nil for pom-only artifacts (no jar). Refs #1630.

Verified: stored integrity for dev.zio:zio-aws-autoscaling_3 5.17.225.2
matches an independent sha1 of the downloaded .jar (16d2a89f...); a full
sync populated 507/507 versions of that package.

[andrew]

A couple of issues to flag before this can go in:

1. Tests are broken. Five existing maven tests now error with WebMock::NetConnectNotAllowedError because version_integrity makes an unstubbed .jar.sha1 request. Running bundle exec rails test test/models/ecosystem/maven_test.rb locally produces 5 errors. Each affected test needs a stub for its .jar.sha1 URL, e.g.:

stub_request(:get, "https://repo1.maven.org/maven2/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/maven-compiler-plugin-3.11.0.jar.sha1")
  .to_return(status: 200, body: "abc123...")

CI didn't run on this PR (fork from first-time contributor needs approval), which is why this wasn't caught.

2. No positive test for the new code. version_integrity adds real parsing logic (regex match, downcase, prefix) and there's no test exercising it. Worth adding one test that stubs a .jar.sha1 with a known SHA1 and asserts integrity == "sha1-<hex>", plus one for the pom-only / 404 case returning nil.

3. Same rescue concern as #1669 — broad rescue StandardError should narrow to Faraday::Error. See the comment on that PR.

[Marc-cn]

Thanks:

1. Added a .jar.sha1 stub in setup so the existing tests no longer error on the new request (the 5 NetConnectNotAllowedErrors are gone)
2. Added two version_integrity tests: a positive case asserting sha1-<hex> from a stubbed sidecar, and a pom-only/404 case asserting nil.
3. pushed before

[andrew]

Thanks for the follow-ups. Setup stub catches the previously-failing requests (43 runs, 0 errors locally), and the two new version_integrity tests exercise both the happy path and the 404 case. LGTM.