Move plugin versions into properties section

[Konilo]

Hello!

This refactors portfolio-app/pom.xml so the remaining hardcoded plugin versions are declared in <properties> as ${<artifactId>.version} placeholders, matching the existing ${tycho-version} pattern. The goal, as discussed in the issue, is to make outdated plugins easier to spot via mvn versions:display-plugin-updates.

Changes

• Lifted 11 plugin versions into the <properties> block: maven-enforcer-plugin, maven-resources-plugin, maven-dependency-plugin, maven-jarsigner-plugin, maven-gpg-plugin, maven-checkstyle-plugin, sonar-maven-plugin, fix-info-plist-maven-plugin, exec-maven-plugin, jacoco-maven-plugin, protoc-jar-maven-plugin.
• Used the dotted Maven convention ${<artifactId>.version}, e.g. ${maven-resources-plugin.version}.
• ${tycho-version} is left as-is — already a property, shared by 8 Tycho plugins, so a short name made sense there. The new properties are 1:1 with their plugins, hence the more explicit <artifactId>.version form.

Not in scope

• The checkstyle library dependency version inside maven-checkstyle-plugin (13.4.2) is intentionally left hardcoded — it is a plugin dependency, not a plugin version, and display-plugin-updates does not check it.

Verification

mvn -f portfolio-app/pom.xml clean verify -Plocal-dev → BUILD SUCCESS, all 13 modules, 0 test failures.

Closes #3244

[Konilo]

@Nirus2000

This PR is unrelated to #5714! :) I'll make a doc PR for #5714 later, though!

[buchen]

@Konilo I believe so far dependabot was updating the dependencies. Will that work with the extracted versions (thinking about it: I guess because it used to work for Tycho)? And: what does the display-plugin-updates require this?

[Konilo]

@buchen

Dependabot: confirmed, and it already works in this repo. Dependabot bumps both styles:

• property-based ${tycho-version} e.g., Bump tycho-version from 5.0.1 to 5.0.2 in /portfolio-app #5382, where it edits the <tycho-version> declaration directly
• hardcoded plugin versions e.g., Bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.6.0.6792 to 5.7.0.6970 in /portfolio-app #5727 (sonar), Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 in /portfolio-app #5703 (enforcer), where it edits the inline <version>

One minor difference: the Dependabot PR titles for these plugins will read "Bump maven-resources-plugin.version from X to Y" instead of the full artifact coordinates, like the tycho PRs do now.

display-plugin-updates: my PR description overclaimed a bit! display-plugin-updates effectively reports outdated plugins regardless of whether versions are hardcoded or stored as properties. So this refactor doesn't change anything on that front. The actual benefit is that, instead of browsing through pluginManagement, you could find all <artifactId>.versions at the top of the file. It also brings these plugins under the property-only goals (versions:display-property-updates, versions:set-property), which would be interesting if you ever want to script a bump (separate from the display-plugin-updates you run today).

To be transparent, I took on this issue because it felt approachable for me as a new comer and was marked as help_wanted. I'll close my PR if this is not interesting in your eyes anymore, no problem :)

[buchen]

Ah, thanks. Now I understand where you're getting from. Yes, I've merged the change. Nowadays, I'm relying on the dependabot updates (could be that the issue is from before that time). But the change improves readability and I have merged it.