feat(sources): add Maven Central package source for JVM MCP servers

[MukundaKatta]

Why

#1102 asks for first-class support for JVM MCP servers (Java/Kotlin/Scala) so they can be published to Maven Central and discovered through the registry. Today the official registry covers npm, PyPI, NuGet, OCI and MCPB; JVM is the obvious gap, and the JVM ecosystem already has a strong single-shot CLI story via jbang (per the discussion comment).

What

Adds a new maven registry type with the same shape as the existing JVM-friendly handlers, following docs/contributing/add-package-registry.md:

• Constants: RegistryTypeMaven, RegistryURLMaven (https://repo.maven.apache.org/maven2), RuntimeHintJBang.
• Validator (internal/validators/registries/maven.go):
  • identifier is groupId:artifactId (e.g., io.github.example:demo-mcp-server); version stays in the dedicated field.
  • Fetches the published POM at <base>/<group/path>/<artifactId>/<version>/<artifactId>-<version>.pom and parses it with encoding/xml.
  • Verifies ownership by matching either an <mcpName>...</mcpName> Maven property (preferred, most explicit) or an mcp-name: <serverName> line in the POM <description> (mirrors the PyPI/NuGet README convention). Maven Central already validates groupId domain ownership at publish time, so a matching declaration in the POM is enough to bind a package to a server name in the same namespace.
  • Body is read through io.LimitReader to keep a hostile mirror from blowing up memory; sanity checks that the POM's own groupId/artifactId match the requested coordinate.
• Wiring: registered in internal/validators/package.go switch.
• Schema/docs:
  • docs/reference/server-json/draft/server.schema.json and internal/validators/schemas/2025-12-11.json: add maven to registryType examples, the Maven Central URL to registryBaseUrl examples, and jbang to runtimeHint examples.
  • docs/reference/api/openapi.yaml: same example additions.
  • docs/reference/server-json/official-registry-requirements.md: add Maven Central to the supported-registries list.
  • docs/reference/server-json/generic-server-json.md: add a Maven (JVM) example with the jbang runtime hint.

Tested

• New internal/validators/registries/maven_test.go exercises:
  • missing identifier / version / wrong identifier shape / disallowed fileSha256 / non-Central base URL rejected,
  • happy path with <mcpName> property and with mcp-name: description fallback (against an httptest.Server),
  • mismatched mcpName, missing ownership signal (asserts the error tells publishers exactly what to add), POM groupId mismatch, 404, and malformed XML.
• Existing TestValidate_RegistryTypesAndUrls invalid_maven case is updated to a invalid_maven_wrong_baseurl case (since maven is now a valid type, but the official registry still restricts it to Maven Central).
• A ValidateMavenAt helper is exported only via maven_export_test.go so the production binary stays minimal while tests can point the validator at an in-process repo.

Closes #1102