[MPIR-473] Do not leak requests to outside repositories

**[Carsten Pfeiffer](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=carsten.pfeiffer)** opened **[MPIR-473](https://issues.apache.org/jira/browse/MPIR-473?redirect=false)** and commented

When using a custom settings.xml or repositories configured in the pom, we should make sure to honor this and only ever contact these repositories for dependencies.

See this output where certain repositories even those found in transitive dependencies are contacted. Not only does this lead to lots of unneeded requests, it also leaks groupIds and artifactIds to these servers.

```
11:57:20.026 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://maven.java.net/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of jvnet-nexus-snapshots has elapsed or updates are forced
11:57:20.028 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://repository.jboss.org/nexus/content/repositories/public/ was cached in the local repository, resolution will not be reattempted until the update interval of JBOSS has elapsed or updates are forced
11:57:20.031 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of sonatype-nexus-snapshots has elapsed or updates are forced
11:57:20.033 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of snapshots-repo has elapsed or updates are forced
11:57:20.036 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/releases was cached in the local repository, resolution will not be reattempted until the update interval of sonatype-releases has elapsed or updates are forced
```

---

**Remote Links:**
- [GitHub Pull Request #92
](https://github.com/apache/maven-project-info-reports-plugin/pull/92)

Start by reviewing the issue's linked GitHub pull request #92 and the repository-resolution behavior described in the debug output. Trace how repositories from custom settings.xml, the POM, and transitive dependencies are considered. Done means dependency requests go only to the repositories explicitly permitted by the configured settings and POM.

Written by the indexing model from the issue text.