build: bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 (#171)

* build: bump dependabot/fetch-metadata from 2.5.0 to 3.0.0

Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.5.0 to 3.0.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@v2.5.0...v3.0.0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build: enforce checksum policy for jitpack repository

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tomasz Zok <tomasz.zok@gmail.com>

Author: dependabot[bot]

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.5.0
+        uses: dependabot/fetch-metadata@v3.0.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

pom.xml

@@ -22,6 +22,12 @@
 
     <repositories>
         <repository>
+            <releases>
+              <checksumPolicy>fail</checksumPolicy>
+            </releases>
+            <snapshots>
+              <checksumPolicy>fail</checksumPolicy>
+            </snapshots>
             <id>jitpack.io</id>
             <url>https://jitpack.io</url>
         </repository>