Maven 3.10.0-rc1 might be fetching (plugin?) prefixes a little too eagerly

### Affected version

3.9.10-rc1

### Bug description

Maven seems to fetch prefixes from repositories and tell you about it. Well, apparently, it felt the need to process plugins (or dependencies?) mentioned in the POM for the dependency-check plugin or one of _its_ dependencies:

```
[INFO] Loaded 23704 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[INFO] Loaded 74 auto-discovered prefixes for remote repository apache.snapshots (prefixes-apache.snapshots.txt)
…
[INFO] --- dependency-check:13.0.0:check (default) @ apache-hc-filecached ---
[WARNING] Could not transfer metadata /.meta/prefixes.txt from/to jvnet-nexus-releases (https://maven.java.net/content/repositories/releases/): (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

The warning is correct: `maven.java.net` is using a self-signed certificate. I don't think the warning is coming from code in `dependency-check`.

Is there any reason why Maven needs to process prefixes from a repository that is likely mentioned in a pom deep in the dependencies?

I can't wait for consumer POMs to spread through the Maven ecosystem so that this kind of historical cruft is no longer a distraction. 😀

The issue names no source files, tests, or entry points. Start by reproducing the dependency-check build and observing why Maven loads repository prefixes from deep dependency metadata. Done should clarify whether this repository traversal is intended and include a regression test or documented resolution for the reported warning.

Written by the indexing model from the issue text.