Make maven build reproducible

[hboutemy]

• Hardcode an initial value for <project.build.outputTimestamp>
• Update maven plugins to version 3.2+

see https://maven.apache.org/guides/mini/guide-reproducible-builds.html

[regisd]

Thanks for your contribution.

[lsf37]

Sorry for the delay, I need to read up a bit on what exactly maven is doing there to understand what we're doing. Reproducible build as such is a good idea, I'm all for it.

[hboutemy]

@lsf37 don't hesitate to ping me if you need any explanation

notice that Reproducible Central is now live and with many releases: https://github.com/jvm-repo-rebuild/reproducible-central
it would be nice to add next release of jflex to the list of independently verified reproducible builds

[regisd]

I think using a timestamp is a bad practice, but it seems Maven can't do better. LGTM.

[regisd]

As far as I understand, this will fix #720. I've updated the change description.

[hboutemy]

I think using a timestamp is a bad practice, but it seems Maven can't do better. LGTM.

you need something reproducible for files timestamp in zip archives: any better idea welcome :)

[hboutemy]

As far as I understand, this will fix #720. I've updated the change description.

no, i don't think so

this PR is about getting the same binary JFlex .jar output when rebuilding: it does not change anything to how JFlex works

[lsf37]

(rebased and resolved conflicts)

[lsf37]

Thanks again for pinging us to do that, and sorry that it took forever..