Describe the bug
Since version 11.0.0 Apache Httpclient is used for web requests instead of plain java.
Configuration properties suppressionFileUser and suppressionFilePassword are no longer respected. (and the alternative configuration using suppressionFileServerId is neither respected).
By intercepting the http request the owasp dependency-check maven plugin tries to make, we can verify that it skips authentication, even when authentication is provided by the user!

Version of dependency-check used
The problem occurs using version 11.0.0 of the maven plugin

Log file

org.owasp.dependencycheck.exception.ExceptionCollection: One or more exceptions occurred during analysis:
        InitializationException: Warn initializing the suppression analyzer: Failed to load http://localhost:8087/suppressions.xml, caused by Unable to fetch the configured suppression file. 
                caused by SuppressionParseException: Failed to load http://localhost:8087/suppressions.xml, caused by Unable to fetch the configured suppression file.

To Reproduce
Steps to reproduce the behavior:

1. Configure maven dependency-check plugin with the following:

<configuration>
    <suppressionFiles>
        <suppressionFile>http://localhost:8087/suppressions.xml</suppressionFile>
    </suppressionFiles>
    <suppressionFileUser>my-username</suppressionFileUser>
    <suppressionFilePassword>my-secret-password</suppressionFilePassword>
</configuration>

2. On linux run netcat listening on port 8087 to intercept traffic and see what authentication maven dependency-check plugin comes up with: nc -l 8087
3. Run mvn dependency-check:check
4. Check your netcat interceptor and you will see something along the lines of:

GET /suppressions.xml HTTP/1.1
Accept-Encoding: gzip, x-gzip, deflate
Host: localhost:8087
Connection: keep-alive
User-Agent: Apache-HttpClient/5.4 (Java/21.0.2)
Upgrade: TLS/1.2
Connection: Upgrade

5. We can see that the Authorization request header is missing!!

Expected behavior
For step 4 in the reproduction steps above, we expect to see the Authorization header present on the request... e.g.:

GET /suppressions.xml HTTP/1.1
Authorization: Basic ........
Accept-Encoding: gzip, x-gzip, deflate
Host: localhost:8087
Connection: keep-alive
User-Agent: Apache-HttpClient/5.4 (Java/21.0.2)
Upgrade: TLS/1.2
Connection: Upgrade

Other comments

• If you run the reproduction steps again, but this time switch the plugin version from 11.0.0 to version 10.0.4 and you will see the Authorization header is present in the requests!