NexusAnalyzer

This adds a new Analyzer which will search Maven Central for the SHA-1 of the dependency. If it is found, the groupId, artifactId, and version are added as Vendor, Product, and Version evidence, respectively. Furthermore, it adds a new Identifier with the Maven coordinates for the jar identified.

You can disable this analyzer by setting `analyzer.nexus.enabled` to `false`. It is set to `false` in `src/main/resources` in order to keep the results of existing tests consistent. The Nexus repository can be changed using the property `analyzer.nexus.url`. By default, it's set to Maven central, but can be changed, for example, if you have an internal Nexus repository which mirrors central.