fix(dev/release): pin surefire version for Java JAR verification (#4948)

Debian's Maven package patches the default surefire version to 2.17,
which doesn't support the JUnit Platform. As a result, no tests in
VerifyReleaseCandidateTest were run and the verification passed without
checking anything.

Pin maven-surefire-plugin to 3.5.2 and enable failIfNoTests so that the
verification fails if no tests are run.

Closes #4947.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: kou

dev/release/verify/java/pom.xml

@@ -93,6 +93,23 @@
     </dependency>
   </dependencies>
 
+  <build>
+    <pluginManagement>
+      <plugins>
+        <!-- Pin the version: some distributions (e.g. Debian) patch Maven's
+             default to surefire 2.17, which can't run JUnit 5 tests. -->
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-surefire-plugin</artifactId>
+          <version>3.5.2</version>
+          <configuration>
+            <failIfNoTests>true</failIfNoTests>
+          </configuration>
+        </plugin>
+      </plugins>
+    </pluginManagement>
+  </build>
+
   <profiles>
     <profile>
       <id>java-25+</id>