BUILD: Move owid-java to the key selection fix, exclude PublicKeyFetch

[jwrosewell]

Summary

Moves the owid-java submodule from 694f6333 to 764996e0, the head of the 51Degrees fork after it took SWAN-community/owid-java main at b92f1cd2 (the tree is identical), and excludes the new HTTP-only PublicKeyFetch class from the pipeline.did build in the same way Endpoints is already excluded.

Why

On 4 September 2026 the OWID ports were found to select a creator's signing key by the moment the key was generated rather than by the start of its period. The 51Degrees cloud writes thirteen weeks of keys in one run, so an identifier dated 4 September selected the key starting 7 September and genuine identifiers were reported as forged. The rule was corrected in the OWID specification (SWAN-community/owid#7) and in every port on 5 September 2026. The Java fix is SWAN-community/owid-java#6, which adds PublicKeySchedule (the key in force at a date is the one with the latest start at or before it, current() is the key in force now and last() is documented as not that), DatedPublicKey, a dated PublicKeyFetch, and writes version 2 and 3 dates as minutes since 1 January 2020.

pipeline.did compiles the submodule source into the module with -Xlint:all -Werror at source and target 1.8. On JDK 21, which the CI matrix runs (Ubuntu_Java_21 and Windows_Java_21), new URL(String) inside PublicKeyFetch is a deprecation warning and the build fails. PublicKeyFetch is the network fetch of a creator's key, which this module does not use: DidClient fetches the cloud's published key list from id/key through its own HttpTransport and selects from it. So the class is excluded, with the pom comment updated to say so. Nothing else in owid-java main references it.

Verification

• mvn -pl pipeline.did test on JDK 21.0.11: 127 tests, 0 failures, 0 errors, 2 skipped (DidClientLiveTests), BUILD SUCCESS. Before the exclusion the same command failed with URL(java.lang.String) in java.net.URL has been deprecated under -Werror.
• Cross-port fixture check compiled against pipeline.did/target/classes: the real identifier the cloud issued on 4 September 2026 with the real thirty key schedule from id/key verifies under the key starting 31 August 2026, and the same schedule with every start moved a week later answers Invalid.

Notes

• A follow up for SWAN-community/owid-java would be to build the URL with URI.create(url).toURL() so consumers compiling with -Werror on current JDKs do not need the exclusion. Not raised there yet.
• No other module in this repository references owid-java.

Produced with AI assistance and checked against the outputs above.