[MNG-5968] Default plugin version updates

[slachiewicz]

o Updated default plugin versions to latest release version to bring in the latest fixes (and issues to report).
o Updated to correct the 'ear' packaging bindings.
o Downgraded the 'maven-plugin-plugin' from 3.4 to 3.3 due to MPLUGIN-296.
o Updated to 'maven-site-plugin' 3.7

[slachiewicz]

I found this changes in abdoned 3.4 line. Should also fix MNG-5992

[hboutemy]

I'm not a fan of default plugins updates in core:

• depending on default versions is a bad practice, we expect users to explicitely choose their version through pluginManagement (and we display a big WARNING in case they don't do it)
• it changes behaviour when switching from one mvn version to the other

then IMHO changing default plugins version should really be driven by key issues that we really want to avoid for untrained people (who don't know the requirement to define their choice): for example MNG-5992 would such an exception (default security is more important than helping people know that they need to choose their plugins versions by letting old plugins versions by default)

[hboutemy]

other topics:

• MNG-5968 is closed
• MNG-5968 is not about default plugins versions, but about Maven core build

if you rework this PR to focus on MNG-5992, ie providing a more secure maven-release-plugin by default in Super POM, I would push this one
If you want to update other plugins, please consider other PRs with other Jira issues, since I will challenge the change seriously :)

[slachiewicz]

Thank you for the explanation, I have seen previous discussions about the update - for sure the refreshment of the topic will be useful like MNG-6169
I have prepared fix for MNG-5992 and clossing this pull.