build: make the POM standalone, remove dependency on org.metricshub:oss-parent

[bertysentry]

Closes #512

What

Removes the <parent> on org.metricshub:oss-parent:5 and inlines everything jawk actually inherited, so every plugin version and configuration is explicit in this repository and managed by Dependabot here.

Inlined from the parent:

• Maven Central publishing: distributionManagement, the maven-central profile (central-publishing-maven-plugin 0.11.0, activated by MAVEN_CENTRAL_TOKEN, with maven.deploy.skip=true) and the release profile (maven-gpg-plugin 3.2.7 signing, maven-release-plugin 3.1.1 with tagNameFormat)
• Artifact attachment: maven-source-plugin / maven-javadoc-plugin attach executions, plus the full javadoc configuration (doclint, sourcepath, failOnError, …)
• Reproducible builds: maven-artifact-plugin buildinfo execution
• License headers: the parent's license-maven-plugin settings (copyrightOwners, process tags, section delimiter, check-file-header execution) merged with the local LGPL configuration
• Site/reporting: jxr, checkstyle, pmd, javadoc, and project-info-reports (same reportSet as before)
• Misc: UTF-8 encoding properties, versions for the default-lifecycle plugins (compiler, resources, install, deploy) and for surefire/failsafe/jar

Intentional differences from the inherited build:

• checkstyle and pmd now use a shared version property for both the verify-phase check and the site report, like spotbugs after build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.3.0 #509. This bumps the pmd site report from 3.26.0 to 3.28.0 so it matches the verify-phase check — closing the same drift class that caused the false SpotBugs annotations.
• The changelog report is gone entirely: it was only declared locally to skip the report inherited from the parent.
• The parent's enforcer/jacoco pluginManagement entries were not carried over — the parent never bound executions for them, so they contributed nothing to the effective build.

Verification

• mvn clean verify site → BUILD SUCCESS with the same artifacts as before (jar, sources, javadoc, standalone shaded jar, .buildinfo) and the full site with all reports (checkstyle 3.6.0, pmd/cpd 3.28.0, spotbugs 4.10.3.0, surefire/failsafe, project-info).
• Diffed help:effective-pom before/after: only the intended differences appear (no parent, pmd report version, dropped changelog/unused pluginManagement entries).
• Diffed the effective POM with -Prelease and with MAVEN_CENTRAL_TOKEN set: gpg signing, release-plugin config, maven.deploy.skip, and the injected central-publishing execution all match the parent-based build.

Remaining validation (issue step 5)

The snapshot deploy to the Central Portal runs on push to main (deploy.yml), so the publishing path gets exercised as soon as this merges — please check that run before cutting the next release.

🤖 Generated with Claude Code