chore(build): bump Maven plugins and move GPG signing to release profile

[marevol]

Summary

Routine maintenance PR to bump Maven build plugin versions and the commons-logging dependency, and to move GPG signing into a dedicated release profile so regular builds don't require a signing key.

Changes Made

• Bumped Maven plugin versions:
  • maven-compiler-plugin 3.14.0 -> 3.15.0
  • maven-javadoc-plugin 3.11.2 -> 3.12.0
  • maven-jar-plugin 3.4.2 -> 3.5.0
  • maven-surefire-plugin 3.5.3 -> 3.5.5
  • jacoco-maven-plugin 0.8.13 -> 0.8.14
  • formatter-maven-plugin 2.26.0 -> 2.29.0
  • central-publishing-maven-plugin 0.7.0 -> 0.10.0
• Bumped commons-logging 1.3.5 -> 1.3.6
• Moved maven-gpg-plugin out of the default build and into a new release profile:
  • Bumped version 3.2.7 -> 3.2.8
  • Enabled <bestPractices>true</bestPractices> as recommended by the plugin
  • Regular mvn verify no longer requires a GPG key; releases use -Prelease

Testing

• mvn test (local) — unit tests pass against the upgraded plugins
• CI will exercise the full build on the PR

Breaking Changes

• Release workflows must now pass -Prelease to activate GPG signing. Any release automation that relied on GPG running unconditionally during verify needs to be updated.

Additional Notes

• No source code changes; this is build configuration only.
• Please confirm the release pipeline invokes Maven with -Prelease before merging if we intend to cut a release off this branch.