What is the intended workflow to pin dependencies in a repository requiring authentication?

In short, the issue is that configuring a repository with basic auth credentials and then pinning the dependency tree results in those basic auth credentials being embedded in `maven_install.json`, which is not a file intended to be edited manually. `netrc` authentication cannot be used until after the dependencies have already been pinned, so the intended sequence of operations to end up with a `maven_install.json` file which does not embed credentials and uses `netrc` for its authentication information is not clear to me.

The actual use case that I am trying to support is storing credentials in a way that allows me to commit all of my BAZEL files to version control without leaking those credentials or forcing all developers and service accounts to use the same credentials.

Below, I have detailed the steps that I personally took to work around this in case it helps to spot the point where I went wrong.

-----

I have a Maven repository which requires authentication. This is a supported use-case noted in the [usage section of the README](https://github.com/bazelbuild/rules_jvm_external#usage), and I was able to download the dependencies.

However, this had two issues: first of all, I did not want to hard-code credentials (especially not in a file that would be committed to version control) and second of all I wanted to pin my dependencies.

When I pinned the dependencies, I expected to be able to use the `netrc_lines` or a `netrc` file to store credentials by either substituting them from environment variables or reading them from a `.gitignore`'d netrc file that each developer could have on their own machine.

This didn't work, though, because pinning the dependencies embeds the exact URLs as built from the repository definitions, including the credentials. I used search-and-replace to remove any instances of the credentials from the generated `maven_install.json` file, but this caused the file to fail checksum. I removed the checksum and the result was something that worked, but throws warnings every time.

I don't think I'm using this feature as intended, but it is not clear to me how I am meant to use the `netrc` parameters to add credentials if I cannot use `netrc` for credentials until I have pinned the dependencies and the dependencies can only be pinned with their credentials already embedded.

Although it doesn't strictly match the issue title, I would also be happy to be informed of any other intended mechanism for allowing credentials to be set per-developer rather than embedding them in version-controlled files.

Start with the usage section of the README and the handling of netrc, netrc_lines, and maven_install.json during dependency pinning. Determine and document the intended workflow for authenticated repositories that keeps credentials out of version-controlled Bazel files and allows per-developer credentials; verify that the resulting pinned file remains valid without checksum warnings.

Written by the indexing model from the issue text.