fix: harden opt-in transport and lock backends against unauthenticated infrastructure

[gnodet]

Summary

Fixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811):

Finding	Severity	Description
f031	MEDIUM	Plaintext minio+http/s3+http repositories evade external:http:* blocking
f032	MEDIUM	Default-config Hazelcast member in build JVM accepts unauthenticated LAN peers
f033	MEDIUM	Redis lock backend trusted unconditionally over unauthenticated plaintext
f034	LOW	Swapped ConfigUtils.getString args ignore bucket config, misroute artifacts

Root cause: Three opt-in modules place infrastructure that gates local-repository integrity outside every defense the platform otherwise applies: MinIO plaintext evades external:http:*, Hazelcast boots with no auth on defaults, Redis accepts any plaintext address.

Fix: Make enabling insecure backends a loud, deliberate act: refuse plaintext without opt-in, fail fast without explicit config, document trust boundary.

Test plan

• Existing tests pass
• MinIO plaintext rejection tested
• Hazelcast fail-fast without config tested
• Redis plaintext refusal tested
• ConfigUtils.getString arg order fixed and unit tested

🤖 Generated with Claude Code

[gnodet]

Well-structured security hardening that correctly guards all three opt-in backends (Hazelcast, Redisson, Minio) against unauthenticated infrastructure defaults. Each backend follows a "fail closed" philosophy appropriate to its role.

@since tag corrections (2 locations)

• RedissonNamedLockFactorySupport.java line 72: @since 2.0.22 → @since 2.0.23
• MinioTransporterConfigurationKeys.java line 67: @since 2.0.22 → @since 2.0.23

Bonus bugfix

FixedBucketObjectNameMapperFactory.java: The ConfigUtils.getString arguments were swapped — the config property name was used as the default value and vice versa, so unconfigured builds would use the literal string "aether.transport.minio.fixedBucketName" as the bucket name instead of "maven". This is a genuine pre-existing bug fix. Consider separating into its own commit for cleaner backport tracking.

Positive observations

• Redisson guard correctly allows loopback addresses for local dev
• Minio guard takes a stricter stance by refusing even loopback HTTP (justified: minio+http/s3+http bypasses external:http:* mirror blocking)
• isInsecureRemoteAddress handles TLS (rediss://), IPv4/IPv6 loopback, and fails closed on unparseable URIs
• httpOvertake path correctly unguarded — when operator explicitly raises Minio priority, the repo IS subject to mirror blocking

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet

[cstamas]

LGTM, with one note for the record: Hazelcast locking is "frozen", is deprecated, should not be used, and is just waiting for Resolver 2.1.x to be dropped