Revert the pom.xml URL change and pin gcp-oidc-auth 1.0.1

[Chuks-Ajeh]

The OIDC migration that landed in this repository also rewrote the pom's artifactregistry:// URLs to https://. On review feedback that part is not wanted, so pom.xml goes back to its pre-migration state — the artifactregistry-maven-wagon extension it already carried is unaffected. The step is also pinned to regnosysops/gcp-oidc-auth:1.0.1, which reports which of the three federation calls was refused instead of failing opaquely.

Worth a reviewer's attention before merging: with the pom back on artifactregistry://, resolution and deployment go through the wagon, which authenticates only through Application Default Credentials — and the pipeline no longer writes a credentials file, because that was the service account key this migration removed. The migration runbook notes the same thing in its troubleshooting section: artifactregistry:// entries "log No credentials could be found because the Maven image has no gcloud". settings.xml supplies GCP_ACCESS_TOKEN as a Basic auth password, which the wagon does not read.

The reference implementation does not settle this either way: rosetta-products has no distributionManagement and never runs mvn deploy, so the runbook has no guidance for a repository that publishes.

[Chuks-Ajeh]

Closing: the pom format that landed here is the one we want after all - all Artifact Registry URLs on https with the wagon kept. Superseded by a PR that only pins the step to 1.0.1.