[Build] Block insecure HTTP Maven repository URLs for defense in depth

[jonathanpeppers]

Summary

Aligning with Gradle & Maven behavior for defense in depth and supply-chain hardening.

When a customer specifies an http:// Maven repository URL, the build now fails with error XA4252 unless AllowInsecureHttp="true" metadata is explicitly set on the item. HTTPS URLs are unaffected.

Problem

A customer could write an insecure http:// Maven repository URL and the product would use it.

Solution

Require explicit opt-in via AllowInsecureHttp="true" metadata:

<!-- This will now fail with XA4252 -->
<AndroidMavenLibrary Include="com.example:library" Version="1.0.0" Repository="http://repo.example.com/maven2/" />

<!-- Explicit opt-in to insecure HTTP -->
<AndroidMavenLibrary Include="com.example:library" Version="1.0.0" Repository="http://repo.example.com/maven2/" AllowInsecureHttp="true" />

This mirrors what Gradle (allowInsecureProtocol) and Maven (<blocked>http://*</blocked>) already enforce by default.

Changes

• MavenDownload.cs — Added HTTP check in GetRepository() that logs error XA4252 when http:// is used without AllowInsecureHttp="true"
• Resources.resx / Resources.Designer.cs — Added XA4252 error message
• MavenDownloadTests.cs — Two new tests:
  • InsecureHttpRepository_Blocked — verifies http:// URL without opt-in produces XA4252
  • InsecureHttpRepository_AllowedWithOptIn — verifies AllowInsecureHttp="true" bypasses the check

[Copilot]

Pull request overview

This PR hardens Maven dependency restore by rejecting insecure HTTP Maven repository URLs unless an explicit item metadata opt-in is provided.

Changes:

• Adds XA4252 validation for insecure HTTP repositories in MavenDownload.
• Adds localized resource entries for the new error.
• Adds unit tests for blocked and opt-in HTTP repository behavior.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/Xamarin.Android.Build.Tasks/Tasks/MavenDownload.cs	Adds HTTP repository validation and XA4252 logging.
src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/Tasks/MavenDownloadTests.cs	Adds tests for blocked and allowed insecure HTTP repositories.
src/Xamarin.Android.Build.Tasks/Properties/Resources.resx	Adds the XA4252 error message resource.
src/Xamarin.Android.Build.Tasks/Properties/Resources.Designer.cs	Adds the generated accessor for XA4252.

Files not reviewed (1)

• src/Xamarin.Android.Build.Tasks/Properties/Resources.Designer.cs: Language not supported