Maintenance: lock down Maven

[cstamas]

Changes:

• use Wrapper and 3.9.12
• make sure CI uses wrapper (we control Maven version not the GH action)
• use release compiler flag instead of source/target to set 11 level
• enable reproducible build

[ianopolous]

A nice bonus could be a test for, at least basic (time invariant), reproducible builds - build twice and check hash equality.

[cstamas]

[cstamas@angeleyes java-ipfs-http-client (fix/lock-down-maven)]$ mvn artifact:check-buildplan
[INFO] Scanning for projects...
[INFO] 
[INFO] ---------------< com.github.ipfs:java-ipfs-http-client >----------------
[INFO] Building java-ipfs-http-client v1.4.5-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- artifact:3.6.1:check-buildplan (default-cli) @ java-ipfs-http-client ---
[INFO] No known issue in 6 plugins
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.394 s
[INFO] Finished at: 2026-01-20T21:00:55+01:00
[INFO] ------------------------------------------------------------------------
[cstamas@angeleyes java-ipfs-http-client (fix/lock-down-maven)]$ 

[cstamas]

Once we are on central, I will register it with Reproducible Central and we will get reports like this:
https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/eu/maveniverse/maven/njord/README.md

[cstamas]

We can also jot down this:
https://gist.github.com/cstamas/1553f4fdb3f7a1a9ecf2f2fc9748c671

And later compare (hint: plugin prefix is eu.maveniverse.maven.plugins). See:

• https://github.com/maveniverse/toolbox
• plugin doc https://maveniverse.eu/docs/toolbox/plugin-documentation/plugin-info.html