Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 (#1187)

Refs OpenIdentityPlatform/commons#325 (workaround only, the issue stays
open)

## Problem

Since the `ubuntu-24.04` runner image 20261004 replaced the system Maven
3.9.x with 3.10.0, releases to Maven Central fail in validation:

```
Bundle has content that does NOT have a .pom file: <every artifact directory>
```

Under Maven 3.10, `central-publishing-maven-plugin` leaves
local-repository files in its staging directory, and they end up in
`central-bundle.zip`:

- `maven-metadata-local.xml` in every artifact directory
- `_remote.repositories` (+ checksums) in every version directory

This first hit OpenIdentityPlatform/commons in release run
[38121296549](https://github.com/OpenIdentityPlatform/commons/actions/runs/38121296549).
The commons issue has the local reproduction and the upstream links.
Plugin 0.8.0 and 0.11.0 behave the same.

## Changes

Same workaround as OpenIdentityPlatform/commons#324:

- `release.yml`: before the release, install Maven 3.9.16 from
`archive.apache.org` with a pinned sha512 and put it first on `PATH`.
`release:perform` runs its nested build with the same Maven.
- `pom.xml`: bump `central-publishing-maven-plugin` from 0.8.0 to
0.11.0. On its own, 0.11.0 does not fix the Maven 3.10 issue.