chore(deps): bump build plugins and dependencies, move gpg signing to release profile

[marevol]

Summary

Routine refresh of Maven build plugins and test/runtime dependencies, plus a build-config tweak to scope GPG signing to release builds only.

Changes Made

• Maven plugins bumped:
  • maven-compiler-plugin 3.14.0 → 3.15.0
  • maven-javadoc-plugin 3.11.2 → 3.12.0
  • maven-jar-plugin 3.4.2 → 3.5.0
  • maven-surefire-plugin (and surefire-junit-platform) 3.5.0 → 3.5.5
  • jacoco-maven-plugin 0.8.13 → 0.8.14
  • formatter-maven-plugin 2.26.0 → 2.29.0
  • central-publishing-maven-plugin 0.7.0 → 0.10.0
• Dependencies bumped:
  • bcprov-jdk18on 1.80 → 1.84
  • JUnit Jupiter 5.10.3 → 5.14.3, JUnit Platform 1.10.3 → 1.14.3
  • Mockito 5.11.0 → 5.23.0
  • Testcontainers 1.20.4 → 1.21.4
• Build config: moved maven-gpg-plugin (bumped to 3.2.8) out of the always-on <build> block and into a new release profile, with <bestPractices>true</bestPractices> enabled. Non-release builds no longer require a GPG signing key.

Testing

• mvn clean test locally to confirm the new Surefire / JUnit / Mockito stack runs the existing test suite.
• Release flow needs to be exercised with -Prelease to pick up the GPG signing step now that it lives in the profile.

Breaking Changes

• For anyone running mvn verify or mvn package expecting artifacts to be GPG-signed, signing now requires -Prelease. CI/release jobs that publish to Central must activate the release profile.

Additional Notes

• Please double-check the release profile is wired into the publishing workflow (e.g. release scripts / GitHub Actions) before the next release.
• BouncyCastle, JUnit, and Mockito jumps span several minor versions — worth a quick scan of test output for any deprecation warnings.