[simonchrz]

The Maven client asked search.maven.org before the configured repository, so a custom base URL still listed Central's versions, every lookup spent a rate-limited search request, and FetchVersions stopped at 200 versions.

FetchPackage, FetchVersions and FetchMaintainers now read maven-metadata.xml from the configured repository.

• FetchPackage sets LatestVersion from <release>, then <latest>, so FetchLatestVersion still finds the right version without timestamps.
• FetchVersions returns every listed version, newest first as before. For Maven Central it also asks the search API (core=gav, rows=200) and copies each doc's timestamp onto the version with the same number, so enrichment and the CLI keep their publish dates. A failed or empty search only leaves the dates out. Other repositories skip the search and get no dates.
• FetchMaintainers reads the POM of the release version.

Checked against Central: net.bytebuddy:byte-buddy now returns all 329 versions.

Tests cover Central with dates for the versions search returns, a search failure that still returns every version, and a custom base URL that never calls search.

Fixes #99

[andrew]

Reading the version list from the configured repository's maven-metadata.xml is right, but dropping the search API also drops every Maven publish date. git-pkgs/enrichment copies PublishedAt from FetchVersions (registries.go:92), and in direct mode the git-pkgs CLI's freshness skips versions with no date and outdated --at finds nothing, so Maven dependencies would get no results from either.

When the base URL is Central (DefaultURL), please still query the search API (core=gav, rows=200) after reading the metadata and copy each doc's timestamp onto the version with the same number. The list itself always comes from maven-metadata.xml, and a failed or empty search just leaves the dates out. For a custom base URL, skip the search entirely. Please add a test for each case: Central with dates filled in for the versions search returns, a search failure that still returns every version, and a custom base URL that never calls search.