StringUtils.replace called with null search string when masking passwords

**Affected version:** HEAD

**Files:**
- `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:376`
- `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:251`

Both `getCommandlineInfo()` methods call `StringUtils.replace()` with a potentially null search string:

```java
// AbstractJarsignerMojo.java:376
commandLineInfo = StringUtils.replace(commandLineInfo, this.storepass, "'*****'");

// JarsignerSignMojo.java:251
commandLineInfo = StringUtils.replace(commandLineInfo, this.keypass, "'*****'");
```

`this.storepass` and `this.keypass` can be null when the user hasn't configured these optional parameters. Whether `StringUtils.replace(null, ...)` throws NPE depends on the implementation of `org.apache.maven.shared.utils.StringUtils.replace()`. If it delegates to `String.replace(CharSequence, CharSequence)`, it will NPE. The pattern is fragile and should guard against null passwords.