feat(java): Support for Maven 4 settings.xml

[knqyf263]

Description

Maven 4 introduces:

• Project-specific settings at ${session.rootdir}/.mvn/settings.xml (apache/maven@e6303aa)
• Repositories defined directly under settings > repositories (docs)

Trivy should support both behaviors.

Expected Behavior

• Detect and read ${session.rootdir}/.mvn/settings.xml if present
• Support repositories defined at the root of settings.xml (settings > repositories)

Discussed in #9896

[DmitriyLewen]

We should use the following order for settings files:
global < project < user

See https://github.com/apache/maven/blob/e6303aae3281e5e87151489bac9db9236dd7eb97/maven-embedder/src/main/java/org/apache/maven/cli/configuration/SettingsXmlConfigurationProcessor.java#L141-L143