Add truststore attrs to maven.install

[contagnas]

This change adds first‑class truststore configuration to maven.install.

This is duplicative with/less general than the existing build --repo_env=JDK_JAVA_OPTIONS=-Djavax.net.ssl.trustStore=<path-to-cacerts> pattern but as far as I can tell there is not a good way to get that to work when the cacert file is in the repo (or built by the repo) and needs to be a relative path.

A simpler alternative to this would be to expand %workspace% variables when handling JDK_JAVA_OPTIONS but this seems more robust and specific.

[shs96c]

Why not set the system JDK via the --server_javabase option to one that has your trust store already configured? You could also do something like startup --host_jvm_args=-Djavax.net.ssl.trustStore=/usr/lib/security/cacerts too. I'm not sure this PR is required. Have I missed something obvious?

[contagnas]

Why not set the system JDK via the --server_javabase option to one that has your trust store already configured? You could also do something like startup --host_jvm_args=-Djavax.net.ssl.trustStore=/usr/lib/security/cacerts too. I'm not sure this PR is required. Have I missed something obvious?

We have cacerts checked into the repo; this allows referring to that file rather than assuming they'll be present on the machine.

This also allows (I think, not sure about ordering) using a cacert built in the repo, e.g. with https://github.com/bazel-contrib/rules_distroless/blob/f553dfe82987b5d592bb83f5a6da8f11a51e66fc/distroless/private/java_keystore.bzl#L43