Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 (#254)

Refs OpenIdentityPlatform/commons#325 (workaround only, the issue stays
open)

## Problem

Since the `ubuntu-24.04` runner image 20261004 replaced the system Maven
3.9.x with 3.10.0, releases to Maven Central fail in validation:

```
Bundle has content that does NOT have a .pom file: <every artifact directory>
```

Under Maven 3.10, `central-publishing-maven-plugin` leaves
local-repository files in its staging directory, and they end up in
`central-bundle.zip`:

- `maven-metadata-local.xml` in every artifact directory
- `_remote.repositories` (+ checksums) in every version directory

This first hit OpenIdentityPlatform/commons in release run
[38121296549](https://github.com/OpenIdentityPlatform/commons/actions/runs/38121296549).
The commons issue has the local reproduction and the upstream links.
Plugin 0.8.0 and 0.11.0 behave the same.

## Changes

Same workaround as OpenIdentityPlatform/commons#324:

- `release.yml`: before the release, install Maven 3.9.16 from
`archive.apache.org` with a pinned sha512 and put it first on `PATH`.
`release:perform` runs its nested build with the same Maven.
- `pom.xml`: bump `central-publishing-maven-plugin` from 0.8.0 to
0.11.0. On its own, 0.11.0 does not fix the Maven 3.10 issue.

Author: vharseko

.github/workflows/release.yml

@@ -51,6 +51,17 @@ jobs:
           server-id: ossrh
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
+      # Maven 3.10 leaves maven-metadata-local.xml and _remote.repositories in the
+      # central-publishing staging directory, and Maven Central rejects the bundle.
+      - name: Set up Maven 3.9
+        env:
+          MAVEN_VERSION: 3.9.16
+          MAVEN_SHA512: 831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6
+        run: |
+          curl -fsSL --retry 5 -o "$RUNNER_TEMP/maven.tar.gz" "https://archive.apache.org/dist/maven/maven-3/$MAVEN_VERSION/binaries/apache-maven-$MAVEN_VERSION-bin.tar.gz"
+          echo "$MAVEN_SHA512  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
+          tar xzf "$RUNNER_TEMP/maven.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/apache-maven-$MAVEN_VERSION/bin" >> "$GITHUB_PATH"
       - name: Cache Maven packages
         uses: actions/cache@v6
         with:

pom.xml

@@ -784,7 +784,7 @@
             <plugin>
                 <groupId>org.sonatype.central</groupId>
                 <artifactId>central-publishing-maven-plugin</artifactId>
-                <version>0.8.0</version>
+                <version>0.11.0</version>
                 <extensions>true</extensions>
                 <configuration>
                     <publishingServerId>ossrh</publishingServerId>