Align build configuration with the ASF parent POM conventions

[slachiewicz]

Nine changes, eight of them taken as inspiration from org.apache:apache:39 and org.apache.maven:maven-parent:49, in support of the goal of keeping per-project POMs small by letting the parent own more. plexus keeps its own parent - this borrows conventions, it does not inherit from the ASF POM.

The first eight change no behaviour for any child build. The ninth raises the Maven version required to build; see below.

What changed

Change	Why
Pin <palantirJavaFormat> to 2.80.0	With a bare <palantirJavaFormat/>, spotless picks a formatter version based on the JDK running the build, so apply on one JDK and check on another can disagree. maven-parent pins it for exactly this reason. 2.80.0 is what spotless 3.9.0 already resolves on JDK 21 and 26, so this is a no-op today and stays one.
Drop the checkstyle <headerLocation>	It pointed at raw.githubusercontent.com under the plexus-11 tag, i.e. a network fetch on every build that ran checkstyle. configLocation now defaults to maven_checks_nocodestyle.xml, which is what every JDK 17+ build already used and which has no RegexpHeader module. The now-redundant checkstyle override and checkstyle.spotless.config property are removed from the java17+ profile.
enforceBytecodeVersion ignores test scope	As maven-parent does. Test-only dependencies routinely ship newer bytecode than the target of the artifact we publish and never reach a consumer's classpath.
Split the enforcer execution in three	enforce-maven-version, enforce-java-version, enforce-bytecode-version, as in org.apache:apache. A child can now relax one check without losing the other two. No child referenced the old enforce-maven-and-java-bytecode id.
externalAvatarImages=false	Published team.html pages currently fetch avatars from a third party. Also excludes org.eclipse.m2e:lifecycle-mapping from the plugin-management report.
version.<artifactId> for every managed version	Most versions were inline literals a child could not override at all, and the few properties that existed used three different naming styles (spotless-maven-plugin.version, mavenSurefireVersion, njord.version). Now uniform, and every managed plugin has a property.
Add <ciManagement>	The ci-management report is enabled in <reporting> but had no data, so every published site carried an empty page.
Add project.reporting.outputEncoding	Present in org.apache:apache.
Require Maven 3.9.0 to build	minimalMavenBuildVersion 3.6.3 → 3.9.0. The plexus-release profile already forced 3.9.0, so releases were built with 3.9.0 while everything else was allowed to build with 3.6.3; that redundant override is removed and the two paths now agree.

Verification

Resolved a real child against the new parent: plexus-utils' POM repointed at 27-SNAPSHOT in a scratch directory with its sources symlinked read-only.

• spotless:check over plexus-utils' 105 Java files passes with the pin in place, resolving palantir 2.80.0 — zero reformatting.
• The child's effective POM shows the three new enforcer execution ids, ignoredScope=test, a single maven_checks_nocodestyle.xml, the project-info-reports config, and no raw.githubusercontent reference.
• mvn validate on the child runs all three enforcer executions independently; all pass.
• spotless:apply then spotless:check clean on this POM.

The Maven 3.9.0 requirement is build-side only

plexus is a POM parent, declares no <prerequisites>, and requireMavenVersion is checked when a project is built, never when its artifacts are consumed. The minimum Maven for anyone depending on a plexus component is therefore unchanged. What changes is that a contributor still on Maven 3.6.x can no longer build.

Two notes for reviewers

No license-header enforcement is happening in plexus today, and this PR does not add it. The headerLocation removed here was doubly dead: checkstyle has no executions in this POM or in any of the 16 child repos, and the JDK 17+ profile already redirected configLocation to the nocodestyle config, which has no header module. Adding a spotless <licenseHeader> — the way maven-parent does — would be the natural follow-up, but the Java sources currently carry at least three header variants (Copyright 2007 The Codehaus Foundation. with per-file years in plexus-io, Copyright The Codehaus Foundation in most of plexus-utils, one ASF-style), so switching it on would rewrite hundreds of files and erase per-file copyright years. That wants a normalisation decision first. src/main/resources/config/plexus-header.txt is now unreferenced; I left it in place rather than delete the record of the canonical header text.

Two inert overrides are left behind. plexus-archiver and plexus-compiler set sisuMavenPluginVersion; both resolve to 1.1.0, which is exactly the value this POM manages. The rename therefore changes no version anywhere — their overrides simply become no-ops and can be dropped in a follow-up child sweep.

Refs the wider cleanup discussed in #333.

_{Drafted with Claude — please verify}