Document mvn-mirrors URL scheme and colon encoding requirements

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 59df028a-0d1b-49cb-8126-ab26408663e4

__tests__/auth.test.ts

@@ -919,7 +919,11 @@ describe('auth tests', () => {
     'https://[2001:db8::1]',
     'https://[2001:db8::1]/maven',
     'https://[2001:db8::1]:8443',
-    'https://[2001:db8::1]:8443/maven'
+    'https://[2001:db8::1]:8443/maven',
+    'https://repo.example.com/maven?redirect=https%3A//upstream.example.com%3A8443',
+    'https://repo.example.com/maven#urn%3Aartifact',
+    'https://repo.example.com/maven?redirect=https://upstream.example.com:8443',
+    'https://repo.example.com/maven#urn:artifact'
   ])('preserves the complete mirror URL %s with an explicit selector', url => {
     expect(
       auth.parseMavenMirrors([`private:${url}:external:http:*,!internal`])
@@ -935,6 +939,7 @@ describe('auth tests', () => {
     'private:https://[2001:db8::1]/maven',
     'private:https://[2001:db8::1]:8443',
     'private:https://[2001:db8::1]:8443/maven',
+    'private:repo.example.com:central',
     ':https://repo.example.com:*',
     'private::*',
     'private:https://repo.example.com:',

action.yml

@@ -76,7 +76,7 @@ inputs:
     description: 'Multiline list of Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`.'
     required: false
   mvn-mirrors:
-    description: 'Multiline list of Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. Use a matching server ID for authentication. Can be used independently of repository inputs.'
+    description: 'Multiline list of Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. The URL must include a scheme; percent-encode colons in its path, query, or fragment. Use a matching server ID for authentication. Can be used independently of repository inputs.'
     required: false
   mvn-repositories-include-central:
     description: 'Include Maven Central for dependency and plugin repositories in the generated profile. When false, Central is disabled for both types unless that type explicitly declares ID `central`. Has no effect when neither repository list is configured.'

docs/advanced-usage.md

@@ -1099,9 +1099,12 @@ Unlike repository profiles, mirrors replace the destination Maven contacts.
 The Central controls described above do not redirect arbitrary POM repositories.
 
 Each nonblank line has the format `mirror-id:mirror-url:mirror-of`. IDs must be
-unique within this input. URL schemes, ports, IPv6 addresses, and colons in
+unique within this input. `mirror-url` must be an absolute URL that includes a
+scheme, such as `https://`. URL schemes, ports, IPv6 addresses, and colons in
 `mirrorOf` selectors are preserved. An explicit `mirror-of` field is required
-after the complete URL, including any port. For example:
+after the complete URL, including any port. Percent-encode colons in the URL
+path, query, or fragment as `%3A`. Otherwise, text after the last unencoded
+colon may be read as the `mirror-of` value. For example:
 
 ```yaml
 steps: