chore(deps): bump build plugins and curl4j, gate GPG signing on release profile

[marevol]

Summary

Routine maintenance bump of build plugins and the curl4j dependency, plus a small build-config change so non-release builds no longer require a GPG key.

Changes Made

• Build plugin bumps
  • maven-compiler-plugin 3.14.0 → 3.15.0
  • maven-javadoc-plugin 3.11.2 → 3.12.0
  • maven-surefire-plugin 3.5.3 → 3.5.5
  • jacoco-maven-plugin 0.8.13 → 0.8.14
  • formatter-maven-plugin 2.26.0 → 2.29.0
  • central-publishing-maven-plugin 0.7.0 → 0.10.0
• GPG signing moved to a release profile
  • maven-gpg-plugin 3.2.7 → 3.2.8
  • Plugin is now declared under a release profile with <bestPractices>true</bestPractices>, so artifact signing only runs when -Prelease is active. Default mvn install no longer fails for contributors without a GPG key configured.
• Runtime dependency bump
  • org.codelibs:curl4j 1.3.0 → 1.3.2

Testing

• mvn install locally with the new plugin versions (without -Prelease) to confirm the build succeeds without GPG.
• The maven-release-plugin flow should be invoked with -Prelease (or the existing release script) to ensure artifacts are still signed at release time.

Breaking Changes

• Release tooling must now pass -Prelease to trigger GPG signing. Anyone running release commands manually should update their command line accordingly. No source/API changes.

Additional Notes

• Reviewer sanity check: confirm the release profile activation matches how the maven-release-plugin is invoked (CI script, release docs) so that signed artifacts continue to be produced for Sonatype Central.