repository_ctx.download doesn't use netrc

### Description of the problem / feature request:
It seems that `repository_ctx.download(url)` doesn't handle netrc auth (while `http_archive`/`http_file` can use it, also wget can fetch same url).

Rule in question is `jvm_maven_import_external` https://github.com/bazelbuild/bazel/blob/master/tools/build_defs/repo/jvm.bzl#L109

### Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Don't have repro yet, will try to add later

### What operating system are you running Bazel on?

NixOS

### What's the output of `bazel info release`?

release 4.1.0- (@non-git)

### If `bazel info release` returns "development version" or "(@non-git)", tell us how you built Bazel.

nixpkgs

Start at tools/build_defs/repo/jvm.bzl line 109, where jvm_maven_import_external calls repository_ctx.download, then inspect the repository_ctx.download implementation and compare it with the netrc behavior of http_archive and http_file. Reproduce the failure with a URL requiring netrc authentication; done means the download succeeds using the configured netrc credentials.

Written by the indexing model from the issue text.