Backport security audit fixes to 3.x (f004-f008, f010, f012)

[gnodet]

Summary

Backports the directly portable security audit findings from the Maven 4 API master branch to the 3.x maintenance line (Maven 3 API):

• f004 (MEDIUM): deployAtEnd state machine — mark DEPLOYED after batch to prevent re-deploy on reactor re-entry
• f005 (MEDIUM): deployAtEnd synchronization — DEPLOY_AT_END_LOCK monitor prevents double-fire under -T
• f006 (MEDIUM): deployAtEnd javadoc — replace false atomicity claim with accurate non-atomicity description
• f007 (LOW): fail-closed skip — unrecognised skip values now fail instead of silently deploying; version-aware reordering
• f008 (LOW): snapshot fallback — warn when release project has only altSnapshotDeploymentRepository configured
• f010 (LOW): URL redaction — mask userinfo in log messages
• f012 (LOW): parse hardening — reject empty id/url in alt-repo syntax

Findings NOT backported

• f001-f003, f009, f011, f013-f015: Maven 4 API only (use Session, ProducedArtifact, Path)
• f016: !deployAtEnd branch doesn't log on 3.x — nothing to invert

API adaptation notes

• Uses ArtifactUtils.isSnapshot() instead of Maven 4's session.isVersionSnapshot()
• Uses MojoExecutionException instead of MojoException
• Uses File instead of Path
• SkipMode enum and parseSkipMode() placed in DeployMojo (reused by DeployFileMojo)
• redactUrlUserInfo() placed in DeployMojo

Test plan

• Unit tests pass (28/28, 0 failures)
• CI integration tests pass (maven-invoker-plugin ITs)
• deployfile-release-skip IT updated for version-aware skip reordering
• deployfile-snapshot-skip IT updated for version-aware skip reordering

Companion to master PRs: #698, #699, #700

🤖 Generated with Claude Code