Outdated: handle more maven-metadata.xml files

[dhalperi]

Fix #507

The current maven-metadata.xml for javax.inject:javax.inject is missing a
release or latest tag.

    <metadata>
      <groupId>javax.inject</groupId>
      <artifactId>javax.inject</artifactId>
      <version>1</version>
      <versioning>
        <versions>
          <version>1</version>
        </versions>
        <lastUpdated>20100720032040</lastUpdated>
      </versioning>
    </metadata>

In this case, grab the first version in the list.

With the new code paths, the control flow was getting hard to track,
so I switched to returning at decision time.

---

This change is 

[dhalperi]

Some notes:

• I regenerated the deploy jar, but I guess a maintainer will want to (re)-do this for security?
• The stack trace in bazel run @maven//:outdated crashes with NPE (4.0, java11) #507 does not line up with the existing source code (L56/L58). So I'm assuming the deploy jar was out of date.
• I didn't see any unit tests to update, please point me there if I should.

[jin]

@cheister shall we switch Outdated.jar to be built from source when it's requested? I'm also thinking of doing the same for the hasher.

[dhalperi]

Would that require users to have to add outdated's deps in some way to our own WORKSPACE files?

[jin]

Yep. That's already needed today if you want to use java_export to Google Cloud Storage, with the deps.bzl setup macros.

[cheister]

Thanks for the PR. I'll look into adding better tests for this class

[cheister]

Do you mind rebasing this PR to get the tests from #511 ?

[dhalperi]

Do you mind rebasing this PR to get the tests from #511 ?

Done. I also rewrote the (commented-out) test to use classpath resources so it doesn't need Internet.

[cheister]

Thanks for the fix!

[dhalperi]

Great! Just checking, what are next steps? Obviously, I won't be able to (squash&)merge the PR.