feat(kotlin): Gradle version catalogs (libs.versions.toml) + Maven Central fetcher

[justin13888]

Admitted by the evaluation in docs/ECOSYSTEM-CANDIDATES.md §2. The JVM clears the registry and OSV gates outright; only the declarative slice of the manifest side is in scope.

Why this slice

Maven Central is canonical, maven-metadata.xml returns the complete version list, and groupId:artifactId is a single string that fits RegistryFetcher::fetch_versions the way npm scopes and Go module paths already do. Maven is the largest language ecosystem in OSV that dependable does not cover — 7,058 advisories, comparable to Packagist (7,039) and Go (8,982), both shipped.

A Gradle version catalog is pure TOML with explicit version literals, so it parses without executing anything and gets --fix for free from the existing span machinery.

Scope

• gradle/libs.versions.toml: [versions] and [libraries], resolving version.ref against [versions].
• A MavenCentralFetcher over maven-metadata.xml (roxmltree is already a workspace dep).
• semver/maven.rs: Maven's qualifier ordering (alpha < beta < milestone < rc < snapshot < "" < sp), 1.0 == 1.0.0, four-plus segments. Wire it into to_semver_constraint and to_semver_versions.
• New Ecosystem::Jvm + ManifestKind variant, osv_name() == "Maven".
• A sample-kotlin fixture, with the byte-span assertion that fixture_elixir.rs uses.

Out of scope

Evaluating build.gradle/build.gradle.kts — they are Turing-complete build scripts, and ground truth needs ./gradlew dependencies, i.e. a JVM daemon and the execution of untrusted build code.

Required behavior

A build.gradle.kts found without a catalog must be reported the way unreadable_lockfiles reports a bun.lockb — visibly unread. A short dependency list must never read as a complete one.

Depends on

The workspace-inheritance generalization (version.ref is structurally workspace = true).