Support local Maven cache (~/.m2/repository) for transitive dependency resolution

## Problem

When scanning Maven projects with transitive dependencies, osv-scanner attempts to fetch parent POMs and BOM files directly from Maven Central (repo.maven.apache.org). Users get rate-limited (HTTP 429) even after running `mvn dependency:go-offline` to populate the local cache.

**Why this matters:**
- Users in rate-limited networks (shared IPs, CI/CD environments, security workshops)
- Offline/air-gapped environments
- Reproducible scans across environments
- Users who have already downloaded dependencies locally shouldn't need to re-download

## Current behavior

```bash
$ osv-scanner scan -r . -f json --maven-registry > report.json
# Still tries to fetch from Maven Central, gets 429 errors like:
failed to get response from https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-starter-parent/2.3.1.RELEASE/spring-boot-starter-parent-2.3.1.RELEASE.pom: API query failed: Maven registry https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-starter-parent/2.3.1.RELEASE/spring-boot-starter-parent-2.3.1.RELEASE.pom query status: 429
failed resolution for Users/bbaukema/Documents/github/veracode-wad26/verademo-java/app/pom.xml: failed to merge parents: failed to load parent from remote: failed to get Maven project org.springframework.boot:spring-boot-starter-parent:2.3.1.RELEASE: failed to fetch Maven project org.springframework.boot:spring-boot-starter-parent@2.3.1.RELEASE:
API query failed: Maven registry https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-starter-parent/2.3.1.RELEASE/spring-boot-starter-parent-2.3.1.RELEASE.pom query status: 429
Error during extraction: (extracting as transitivedependency/pomxml) failed resolution for Users/bbaukema/Documents/github/veracode-wad26/verademo-java/app/pom.xml: failed to merge parents: failed to load parent from remote: failed to get Maven project org.springframework.boot:spring-boot-starter-parent:2.3.1.RELEASE: failed to fetch Maven project org.springframework.boot:spring-boot-starter-parent@2.3.1.RELEASE:
API query failed: Maven registry https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-starter-parent/2.3.1.RELEASE/spring-boot-starter-parent-2.3.1.RELEASE.pom query status: 429
```

**Workaround:** Serve the local cache via HTTP:
```bash
cd ~/.m2/repository
python3 -m http.server 8080

# In another terminal:
osv-scanner scan -r . -f json --maven-registry http://localhost:8080 > report.json
```

## Desired behavior

One or more of:
1. **Auto-use local Maven cache**: Check `~/.m2/repository` before attempting network requests
2. **file:// protocol support**: Accept `--maven-registry file://~/.m2/repository`
3. **Offline transitive resolution**: Enhance `--offline-vulnerabilities` to also resolve transitive dependencies from cache
4. **Priority order**: Network as fallback, not primary

## Related flags

- `--maven-registry` — already exists but only works with HTTP/HTTPS
- `--offline` — exists but requires pre-downloaded OSV databases, doesn't help with Maven resolution
- `--offline-vulnerabilities` — similar limitation

Start with Maven transitive resolution behind --maven-registry, --offline, and --offline-vulnerabilities, using ~/.m2/repository and the reported parent POM failure as the reproduction. Compare local-cache and HTTP registry behavior, then verify that cached parent and BOM files are used before network requests and that the existing scan still resolves dependencies correctly.

Written by the indexing model from the issue text.