DLPX-97954 Add support for local maven build for password-vault-manager

[justsanjeev]

Problem

Testing an in-progress password-vault-manager (PVM) change against the appliance build
currently requires that change to already be published to Artifactory, since
packages/virtualization/config.sh always resolves PVM at the version pinned in
dlpx-app-gate's appliance/gradle.properties. Anyone validating a cross-repo change
between dlpx-app-gate and password-vault-manager has to wait for a PVM publish (or
manually hack the pinned version) before they can even build the appliance against it,
which adds unnecessary iteration latency to development and pre-checkin testing.

Solution

Add an opt-in hook to packages/virtualization/config.sh, gated behind two new
environment variables, PVM_GIT_URL and PVM_GIT_BRANCH:

• When both are set, build() shallow-clones that ref of password-vault-manager, runs
  ./gradlew publishToMavenLocal (skipping test/dxosTest, since those already ran as
  part of the password-vault-manager-precommit-tests step earlier in the
  pvm_precheckin flow) to publish the jar into ~/.m2/repository, and passes
  -Dthird.party.local.maven.root=file://$HOME/.m2/repository and
  ORG_GRADLE_PROJECT_passwordVaultManagerVer=<local version> to the ant build, so ivy
  resolves the locally-built jar instead of the Artifactory one.
• When either variable is unset (the default, unchanged path), PVM continues to be
  fetched from Artifactory using the version pinned in appliance/gradle.properties --
  no behavior change for existing builds.

This lets a developer point a virtualization build at an unpublished PVM branch for
local validation without touching the pinned version or waiting on a publish.

Testing Done

#	Test	How	Status
1	Run integration-tests/password-vault-manager-precommit-tests/pre-push (unit + dxos tests)	Downstream Jenkins job, triggered with propagate: false	Implemented in PR #4604 (834231db1)