JCR-5266: Publish Build Scans to develocity.apache.org

[clayburn]

JCR-5266

Publishes Build Scans from Jackrabbit builds to Develocity, the ASF's instance. Read more on Develocity.

• .mvn/extensions.xml: Develocity Maven extension 2.6.0 and Common Custom User Data extension 2.4.0
• .mvn/develocity.xml: server https://develocity.apache.org, project ID jackrabbit. It follows Apache Curator's setup: Build Scans are published only when authenticated, and IP addresses are obfuscated
• build.yml: the Build step exports DEVELOCITY_ACCESS_KEY from a secret
• CI is detected through GITHUB_ACTIONS (GitHub Actions)
• .mvn/.develocity/ (local Develocity state) is added to .gitignore and excluded from RAT

I checked this with mvn -B -ntp validate on Maven 3.10.0. The build succeeded, the extension loaded, and no scan was published because no key was present. apache-rat:check reports 0 unapproved files. Builds without a key behave as they do today.

Before merging: a PMC member needs to open an INFRA JIRA ticket asking for apache/jackrabbit to be given access to the shared DEVELOCITY_ACCESS_KEY organisation secret for develocity.apache.org. Until access is granted, CI builds will not publish Build Scans, and nothing will fail. Once access is granted, the Build Scans will not publish from this fork, only from builds which originate from apache/jackrabbit.

@rombert, following up on our conversation at Community Over Code today. Could you file that INFRA request?

[rombert]

Hi @clayburn

Thanks for jumping in with a PR. The discussion is ongoing at https://lists.apache.org/thread.html/s7r281wf76lcy5808c0oszmcdr1cq867 , the project has not yet taken a decision. We will take action once we reach a conclusion.

[clayburn]

Thanks @rombert, all good. If the project declines, feel free to just close this.