feat(maven): allow the OSS Index password to be read from an environment variable

[liotur]

Description of Change

Maven logs the plugin configuration unmasked when run with -X, so an ossIndexPassword passed with -D or set in the pom ends up in the build log. The NVD API key already has nvdApiKeyEnvironmentVariable for this. This adds ossIndexPasswordEnvironmentVariable to the Maven plugin, which works the same way and uses the same precedence: ossIndexPassword > ossIndexPasswordEnvironmentVariable > ossIndexServerId. ossIndexUsername is still applied alongside it for legacy OSS Index tokens. If the named variable is unset or empty, the server id is not used as a fallback; that deliberately mirrors the NVD handling.

aikebah asked for this option on #7631 and also noted that nvdApiKeyEnvironmentVariable was missing from the Maven configuration page, so this adds that row too. As he suggested there, the ossIndexPassword docs now steer users to the server id or the environment variable instead of setting the password directly.

NVD already has this option, so this adds it for OSS Index only. As aikebah suggested on #7640, the user/password settings for on-prem services (Nexus, Artifactory, NVD datafeed mirrors, the database) are left for separate changes. This is also Maven only: Ant and the CLI don't have the NVD environment variable option either, and the Gradle plugin lives in its own repository. I've marked #7642 as related rather than fixed, so you can decide whether it should stay open for those.

Related issues

• relates to feat: allow secrets to be passed via environment variables #7642

Have test cases been added to cover the new functionality?

Yes. Three unit tests in BaseDependencyCheckMojoTest run populateSettings() and check that the variable is read, that it takes precedence over ossIndexServerId, and that a directly set ossIndexPassword takes precedence over it. The first two fail without the change; the third guards the existing behavior.

mvn -pl maven -Dtest=BaseDependencyCheckMojoTest test passes (9/9) on JDK 25, and so do the rest of the maven module's unit tests (20/20).