Correctly handle alternative Maven registries when storing OSV reports

[calebbrown]

The OSV schema supports alternative Maven registries by include adding :<registry-url> to the Maven ecosystem for a package.

For example Maven:https://maven.google.com points to the Google Maven registry, not Maven Central.

[calebbrown]

Investigating the code suggests that this is already supported.

The report would likely land in the directory ./osv/malicious/maven:http:-maven-google-com.

It may be worth relaxing the rule of stripping . if it doesn't appear at the start of the path segment.

The OSV.dev corpus does not yet include any reports for registries other than the default Maven Central.