(Final?) change to Shibboleth Project repository handling

[Cantor, Scott]

TL;DR, see https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/2891317253

With the 4.3.0 IdP and OpenSAML releases, we have updated the project parent (11.3.5) and removed all Maven repositories from the POM. As a result of this change, the link above includes the settings required in Maven (either in settings.xml or in your own project POMs) to reference the project's Maven repositories for our artifacts.

In conjunction with this, we are removing all direct access to Nexus from the public Internet, and leaving only the read-only URLs documented per that page.

Why are we making this change?

One reason is to avoid having to permanently commit to any of these URLs, old or new, for the long term. Keeping them out of the POMs prevents them from being locked in as part of the interface of the projects, which has caused problems.

The other reason is that Maven will tend to try any repository it knows about for any artifact it needs, which causes lots of extra traffic and has led Maven Central to strongly discourage hosting of artifacts that contain third party repository URLs.

That said, while we are making this change in part to accommodate Maven Central and make the artifacts "safer" for upload there, that situation hasn't changed; we still have nobody willing or able to accept the risk of unlimited liability in putting them there due to their terms of service, and we do not foresee that changing (we did ask them).

So we have no choice for now but to continue to require use of our own repositories, and require third party developers to deal with that limitation as we have documented. It is our hope that things will stablize in this regard from here on out, and if a change allowing the artifacts to be put into Central happens, the existing signed artifacts will now accommodate that.

-- Scott