Fix Maven released? check for non-jar packaging types (e.g., aar)

[kbukum1]

What are you trying to accomplish?

When a Maven artifact uses non-jar packaging (e.g., aar), but the consumer POM omits <type>, the parser defaults to "jar". This causes released?() to HEAD-check .jar URLs that always return 404, wasting ~2 minutes per run.

For example, io.grpc:grpc-cronet is packaged as aar — the .jar never exists, but the .pom always does.

Now released? falls back to a .pom HEAD check when the artifact returns 404 (only when no classifier is present).

Fixes #14843

Anything you want to highlight for special attention from reviewers?

The fallback is intentionally narrow:

• Only triggers on 404 (not 401/403/500)
• Skipped when a classifier is present
• Uses .pom since every published Maven artifact has one

How will you know you have accomplished your goal?

All related Maven tests pass (133 examples, 0 failures), including 4 new test cases covering the fallback behavior.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR improves Dependabot’s Maven released? determination by handling artifacts whose published packaging type isn’t jar (e.g., aar) when the consuming POM omits <type> and the code otherwise defaults to checking a .jar URL that will 404.

Changes:

• Added a .pom URL helper and introduced a narrow .pom fallback in released? when the artifact URL returns HTTP 404 and no classifier is present.
• Added/updated RSpec stubs and examples to cover the new fallback behavior and keep existing “unreleased” simulations accurate.
• Updated version finder specs to stub .pom HEAD requests in scenarios that now trigger the fallback.

Show a summary per file

File	Description
maven/lib/dependabot/maven/shared/shared_package_details_fetcher.rb	Implements .pom URL generation and 404-only fallback logic in released? (skipping classifier cases).
maven/spec/dependabot/maven/shared/shared_package_details_fetcher_spec.rb	Adds focused test coverage for the .pom fallback and ensures existing 404 cases stub both artifact and pom.
maven/spec/dependabot/maven/package/package_details_fetcher_spec.rb	Updates unreleased-version stubs to account for the new .pom fallback path.
maven/spec/dependabot/maven/update_checker/version_finder_spec.rb	Updates stubs in 404 scenarios so version selection logic remains deterministic with the new fallback.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0