Standardize the README license footer

Parse Maven build coordinates (#18)

* Parse Maven build coordinates

* Document parsed build coordinates

Reduce POM parsing and resolution allocations (#17)

* Optimize POM parsing and resolution

* Accept UTF-8 BOM-prefixed POMs

* Guard incomplete interpolation expressions

Jail LocalFetcher to a root directory and cap POM read size (#10)

Reject absolute paths and symlinks in LocalFetcher parent traversal (#3)

LocalFetcher.walk follows <relativePath> from POM files to resolve
parent chains. Absolute paths and symlinks could redirect reads
outside the project tree. Now rejects absolute <relativePath> values
and uses os.Lstat to skip symlinks at each step.

Add LocalFetcher and ResolveLocal for filesystem-only parent resolution

Use cosign v4 bundle format for release signing