[MNG] Warn or fail when an external-model profile repository shadows central

[gnodet]

Problem

When a dependency POM contributes a repository through a JDK/OS/activeByDefault-activated profile (the legitimate path, see #13100 / #13116 / #13141), that repository can declare a URL that shadows central or another well-known repository with a different (potentially malicious) URL.

Maven currently has no defense against this: the repository is accepted as-is and used for artifact resolution.

Proposed Solution

Implement a WARN (or optionally FAIL with a flag) policy that triggers when:

• A repository contributed by an external-model profile has the same <id> as a repository already registered in the effective repository list (e.g. central), but a different URL.

This is a repository URL-mismatch check, scoped to the dependency resolution path.

Non-goals

• This issue does not revert the fix in [3.10] Questions to discuss #13100 / Fix #13100: honor repositories from legitimately-active external model profiles #13116 / Fix #13100: honor repositories from legitimately-active external model profiles #13141. The blanket stripping was over-broad.
• The check should apply only when a conflict is detected, not as a general ban on external-model profile repositories.

Notes

• Discussed in [3.10] Questions to discuss #13100 and deferred from Fix #13100: honor repositories from legitimately-active external model profiles #13141 (forward-port of Fix #13100: honor repositories from legitimately-active external model profiles #13116 to master).
• A // TODO(#428) marker has been added at the relevant call site in DefaultModelBuilder as a reminder.
• The redefinition concern is orthogonal to the activation fix and should be addressed as a separate hardening item.