Repository params of the maven plugin should be read-only

Today it's possible to configure where the local maven repo is as well as the remote repos, which should never be necessary. These params should be marked @readonly (and @required).

This could break backwards-compatibility with someone using the existing "feature" to configure this, but I think this change could be ok for Cargo 1.1.