Fix macOS Analyzers Build: add repox credentials

[saberduck]

• Add SonarSource/ci-github-actions/config-gradle@v1 to macos_analyzers job
• Without credentials, Gradle falls back to Gradle Plugin Portal and artifacts have different checksums than those recorded in gradle/verification-metadata.xml (repox normalizes POMs)
• Same fix already applied to cross_platform_analyzers in RUST-137 Add gradle/verification-metadata.xml for dependency verification #226

[sonar-review-alpha]

Summary

This PR adds repox credentials to the macOS Analyzers build and enables manual workflow triggering.

Main change: Adds the SonarSource/ci-github-actions/config-gradle@v1 action to configure Gradle with repository credentials. Without these credentials, Gradle falls back to the Gradle Plugin Portal, which publishes artifacts with different checksums than the internal repox repository. This causes verification metadata validation to fail. The repox repository normalizes POMs, avoiding this checksum mismatch.

Secondary change: Adds || github.event_name == 'workflow_dispatch' to allow manual triggering of the macOS build via GitHub Actions UI.

This mirrors the credentials fix already applied to cross_platform_analyzers in PR #226.

What reviewers should know

Key areas to review:

• The config-gradle action is added directly before the build step (line 42). This is the standard placement and matches the pattern used in cross_platform_analyzers.
• The action uses SonarSource/ci-github-actions/config-gradle@v1 — confirm this is the expected version and matches what's used elsewhere in the workflow.
• The workflow_dispatch change is independent; it enables manual runs but does not affect the credentials flow.

Context for reviewers:

• This is a security-related change (adds credential handling) but uses SonarSource's official GitHub Action, so credentials themselves are not embedded in the workflow YAML.
• The checksum mismatch issue stems from differences in how POMs are normalized between repositories — this is a known issue when switching between artifact sources.
• If you want to verify the pattern matches the earlier fix, check the cross_platform_analyzers job in the same workflow file.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed for 'sonar-rust'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube