Rethink cyclonedx-maven-plugin execution during releases

[jamesnetherton]

I got banned from accessing repository.apache.org due to excessive 404s. I think it's related to the cyclonedx-maven-plugin, where it tries to resolve every CQ artifact before anything has been deployed.

We probably need to try and move execution of the plugin to the end of the release and exclude the SBOM bits from the source package (since they'll be out of date).

[jamesnetherton]

I'll close this for now. It's not simple to resolve.

cyclonedx-maven-plugin execution has to be defined in the project root pom.xml so it can aggregate all of the project dependency info. So we can't move it to some other module or any later maven phase.

What might work would be to tweak the maven-release-plugin config so that the project release artifacts are installed after release:prepare. But that's an overhead I'd like to avoid for now.

We can revisit if this becomes a recurring release issue.