HSEARCH-4415 Define maven gpg plugin for public artifacts

[fax4ever]

https://hibernate.atlassian.net/browse/HSEARCH-4415

This change should be limited to where a new deploy/release is performed.

To test the deploy run the maven command:

mvn clean deploy -X -DskipTests -DperformRelease=true

There are a series of pre requirements:

1. The Maven settings.xml file must contain the nexus coordinates and the GPG passphrase:

<servers>
  <server>
    <id>ossrh</id>
    <username>ossrh-username</username>
    <password>ossrh-password</password>
  </server>
  <server>
    <id>gpg.passphrase</id>
    <passphrase>fax</passphrase>
  </server>
</servers>

2. The private key must be imported into the local machine GPG process

gpg --batch --import $gpg_secret

To make the worker node we could consider the idea of this blog.

[fax4ever]

Running in on my local machine:

[yrodiere]

It turns out you cannot add the gpg passphrase to the settings.xml using Jenkins credentials (https://issues.jenkins.io/browse/JENKINS-40703) ; I'll find another way and push additional commits.

[yrodiere]

I pushed a commit to enable artifact signing in the Jenkinsfile. It requires hibernate/hibernate-noorm-release-scripts#9, which hasn't been merged yet.

Now I need to think about how I'll test all this. Please don't merge just yet.

[fax4ever]

I added a comment here: hibernate/hibernate-noorm-release-scripts#9

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[yrodiere]

Merged with a few additional commits, thanks.