Extension descriptors in the WAR aren't fully reproducible

The .xed extension descriptors in the WAR contain the repository list at build time, which makes the build not really reproducible. Further, user.name leaks in via third-party POM interpolation: Grizzly's scm URL is ssh://${user.name}@git.java.net/… which is replaced at build time, so 3 .xed files in the XIP say contain the current user's name. These differences then also affect the XIP and Debian packages.