Repository information for Maven ecosystem

[ctron]

According to the specification, the Maven ecosystem can carry an additional repository URL: https://ossf.github.io/osv-schema/#affectedpackage-field

The ecosystem string might optionally have a : suffix to denote the remote repository URL that best represents the source of truth for this package, without a trailing slash (e.g. Maven:https://maven.google.com). If this is omitted, this is assumed to be the Maven Central repository (https://repo.maven.apache.org/maven2).

Right now the Ecosystem::Maven variant doesn't support this.

[gcmurphy]

Good catch. In hindsight it would be nice to have a more generic solution for the versioned ecosystems like Debian and Alpine too.

[ctron]

Maybe a (breaking) change could be to have Ecosystem::Maven(String) or Ecosystem::Maven{group_id: String}?

I can come up with a PR if that helps.