[MNG-8076] when jar in local repository from other repository id, should not reject but check if it is also available in current repository id context

**[Hervé Boutemy](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hboutemy)** opened **[MNG-8076](https://issues.apache.org/jira/browse/MNG-8076?redirect=false)** and commented

precise context: Reproducible Central https://github.com/jvm-repo-rebuild/reproducible-central
in the past, I rebuilt maven-shade-plugin 3.5.2 during the vote, which downloaded the reference jar in a staging remote repository with "reference" id (that's part of the artifact:compare logic in Apache staging: see https://github.com/jvm-repo-rebuild/reproducible-central/issues/140 for details on this recent Reproducible Central feature)

When I'm trying to rebuild a project that uses this maven-shade-plugin 3.5.2 release, I get:

```
[INFO] Artifact org.apache.maven.plugins:maven-shade-plugin:pom:3.5.2 is present in the local repository, but cached from a remote repository ID that is unavailable in current build context, verifying that is downloadable from [central (https://repo.maven.apache.org/maven2, default, releases)]
```

looking in the local repository, I get

```
cat ~/.m2/repository/org/apache/maven/plugins/maven-shade-plugin/3.5.2/_remote.repositories
#NOTE: This is a Maven Resolver internal implementation file, its format can be changed without prior notice.
#Sun Feb 18 15:03:27 UTC 2024
maven-shade-plugin-3.5.2-sources.jar>reference=
maven-shade-plugin-3.5.2.pom>reference=
maven-shade-plugin-3.5.2.jar>reference=
maven-shade-plugin-3.5.2-source-release.zip>reference=
maven-shade-plugin-3.5.2-cyclonedx.xml>reference=
maven-shade-plugin-3.5.2-cyclonedx.json>reference=
```

the fact that all these artifacts were initially downloaded through "reference" repository id does not mean that they are not **also** available with the "central" id

as a precise workaround, i did not delete the _remote.repositories file but replaced reference with central and it works as expected. The opposite update can restore the failing behaviour...

for now, I know that by rebuilding releases from Apache staging area, I'm polluting my local repository :/

---

**Affects:** 3.9.6

**Issue Links:**
- [MNG-5185](https://issues.apache.org/jira/browse/MNG-5185) Improve "missing dependency" error message when _maven.repositories/_remote.repositories contains other repository ids than requested

- [MRESOLVER-333](https://issues.apache.org/jira/browse/MRESOLVER-333) Distinguish better resolver errors for artifact availability

- [MRESOLVER-555](https://issues.apache.org/jira/browse/MRESOLVER-555) Existence check should lax the repository update policy

Start with Maven's handling of the local repository _remote.repositories file and read the linked MNG-5185, MRESOLVER-333, and MRESOLVER-555 context. Reproduce the case using artifacts recorded under the reference repository id while central is the current context; done means availability is checked in the current context instead of rejecting the artifact solely because it was cached under another id.

Written by the indexing model from the issue text.