Index the pom once for hosted Maven rewrites

Re-reading the pom through PomScope for every patched dependency made
hosted Maven scans slower (scan-performance flagged maven/hosted
+35%, maven/rescan +25%). The rewriter now reads the pom once into a
PomIndex and keeps its offsets in step with its own edits (version
rewrites, repository and dependencyManagement insertions, superseded
repository removal, URL refresh), so a pom with many patched
dependencies is scanned once instead of once per dependency. A
1000-dependency pom rewrites in ~25 ms, down from ~1.7 s before this
PR series. A unit test checks the kept index against a fresh build
after every kind of edit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko