Add support for provenance discoverable on Maven Central

[benmss]

Currently, provenances are only automatically discovered from npm, or user provided JFrog repositories. Some projects hosted on Maven Central also have provenance files alongside artefacts, and these can be supported too.