fix: accept locally cached artifacts via same-id fallback when tracking URL changes

[gnodet]

Summary

When the tracking key function is URL-qualified (nid_hurl, the default since 2.0.23 / commit 339161b), tracked artifacts become unavailable in two situations:

1. Legacy entries: tracking file written by an older resolver using ID-only keys (nid format, e.g. artifact>central=).
2. URL mismatch: artifact downloaded from a repo with the same ID but a different URL (e.g. real Central tracked as central-<sha1(realUrl)>= vs ITs overriding central to file:target/null which produces a different sha1).

In both cases the artifact IS present and WAS downloaded from a repository with the same logical identity (same repo ID). The resolver currently forces a full re-download, which fails in CI environments and integration tests that use fake/file-based repository URLs — see apache/maven#13078 (comment).

All 9 IT jobs fail (4229 failures) because ITs override central to file:target/null to prevent remote access, but nid_hurl treats sha1(file:target/null) ≠ sha1(https://repo.maven.apache.org/maven2) as a different repository.

Fix

Add a two-stage fallback in applyTracking():

• Stage 1: try the system-wide key function (nid, ID-only) — catches legacy tracking entries from older resolvers.
• Stage 2: prefix-based match on repoId- — catches same-id entries written with a different URL hash (the IT scenario where central is redirected to file:target/null).

The entry will be upgraded to the current key format on the next download.

Note: This effectively makes nid_hurl a recording-only mechanism: tracking entries are written with URL-qualified keys, but lookups fall back to repo-ID-only matching. The f013 security protection (rejecting same-id-different-URL repositories) is relaxed in favor of backward compatibility and the widely-used IT pattern of overriding repository URLs. A stricter model would require all downstream consumers (including hundreds of ITs) to stop relying on URL-stable repository identities.

Tests

• Updated testUrlQualifiedTrackingDistinguishesSameIdDifferentUrl → testUrlQualifiedTrackingSameIdDifferentUrlAcceptedViaFallback: same-id-different-URL now accepted
• testUrlQualifiedTrackingAcceptsLegacyIdOnlyEntriesViaFallback: legacy nid entries accepted via stage 1
• testUrlQualifiedTrackingRejectsLegacyIdOnlyEntriesFromDifferentRepo: different repo ID still rejected
• testUrlQualifiedTrackingAcceptsSameIdDifferentUrlEntries: IT scenario (Central → file:target/null) verified
• Updated factory tests to reflect relaxed behavior

[github-actions]

@cstamas Please assign appropriate label to PR according to the type of change.