Implement a global non-maven download policy

The Spotless core has few dependencies. During plugin configuration, we add maven dependencies which get downloaded in the normal way.

There are some exceptions where we use non-maven formatters. For example

- npm-based formatters which grab dependencies using npm install
- eclipse-based formatters which download dependencies from p2 update sites
- #1629
- #1658

There are other cases we are considering, such as

- #1663
- #674
- #673

A very good thing about Spotless is that it "just works". Search the docs for the kind of formatter you want, specify that formatter, and you're ready to go. But for these non-maven-based formatters, I think it's fair for users to be surprised that their build plugin is making network requests and caching artifacts outside of the expected maven channel.

I'm proposing something like this:

```gradle
spotless {
allowDownloadsFrom('https://download.eclipse.org/')
```

As a user, it would work like this:

- I add Eclipse CDT to my spotless configuration
- I get an error like so

> Eclipse CDT is not available in a maven repository, it must be downloaded from a p2 repository. You can allow this download by adding a block like this to your spotless configuration
>
> spotless {
>   allowDownloadsFrom('https://download.eclipse.org/')
>
> This will allow Spotless to download p2 metadata and jar files using the Equo p2 client. The metadata and jar files will be cached at ~/.equo. Alternatively, you can specify an alternative p2 update site, and add that URL to your allowDownloadsFrom.

It's not a perfect mechanism, it relies on our own diligence in making sure that PR's such as the Rome PR follow the rules about checking the allowed URLs. But it takes away the surprise, which is important. Users might choose a different formatter based on whether it is available through a standard maven proxy or not.