Actually use :plugin-repositories. Fixes #1474.
Fix weird de-duping behaviour in pom.

It used to be we would merge a bunch of profiles into the project, and
then trim out dupes based on group/artifact/version, which was totally
wrong; it ignores classifiers and extensions.
Merge remote-tracking branch 'upstream/master'