feat(no-ticket): add Maven shell-plugin credential helper

[cloudsmith-iduffy]

Description

Adds a Maven credential helper to the CLI. Maven has no native credential-helper protocol, so this uses a shell-plugin approach: a mvn shim (placed first on PATH via cloudsmith credential-helper shell-init) transparently forwards to cloudsmith exec -- mvn …, which provisions an ephemeral settings.xml from the resolved credential (API key or OIDC), runs the real mvn, and cleans up afterwards.

Highlights:

• cloudsmith exec — a generic, top-level command that runs any command with Cloudsmith credentials provisioned for it; the package manager is inferred from the command (no format argument), and commands with no integration run unchanged. Plus credential-helper shell-init and install maven (with --repo / --server-id).
• A single injected <server> authenticates both dependency resolution (download CDN) and distributionManagement (native Maven upload) — Maven matches it by <id>, not host.
• Custom-domain aware, generically: a reusable common.repo_path_segment helper org-scopes Cloudsmith URLs (a custom domain is bound to one org, so the <org> path segment is dropped; the *.cloudsmith.io defaults keep it). Used by both the download and upload URLs.
• settings.xml lives in cloudsmith_cli/templates/maven_settings.xml.tmpl (real XML, editor-validated) and is rendered via a shared templates.render() that webserver.py also uses.
• Shell-plugin state (plugins.json, shims) lives in the CLI config dir (get_default_config_path()), consistent with the custom-domain cache.
• Built test-first: full suite (552) and pre-commit hooks green.

Proven end-to-end with GitHub OIDC (no API key anywhere) — install, build (download), and a native mvn clean deploy (upload), with ~/.m2 caching:

• Example workflow: https://github.com/cloudsmith-iduffy/cloudsmith-cli-oidc-test/blob/main/.github/workflows/maven-oidc.yml
• Successful run logs: https://github.com/cloudsmith-iduffy/cloudsmith-cli-oidc-test/actions/runs/27446939107/job/81133936145#step:5:1

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• The linked test-repo workflow doubles as a real-world usage example and a living smoke test (OIDC auth, custom-domain discovery, dependency caching). The whole Cloudsmith story is three bare commands: install maven, eval "$(… shell-init)", mvn clean deploy.
• New subpackages and the template file are picked up by find_packages / existing package_data; no packaging changes needed.