chore: migrate Maven deployment from OSSRH to Maven Central Portal

[bpauli]

Summary

• Replace org.sonatype.plugins:nexus-staging-maven-plugin:1.6.7 with org.sonatype.central:central-publishing-maven-plugin:0.8.0 in the release profile.
• Switch the .github/workflows/settings.xml profile and server id from ossrh to central and point at https://central.sonatype.com/repository/maven-{releases,snapshots}/.
• Rename the credential env vars from SONATYPE_USERNAME/SONATYPE_PASSWORD to MAVEN_CENTRAL_USERNAME/MAVEN_CENTRAL_PASSWORD in maven-release.yml and settings.xml, and switch the active Maven profile from ossrh to central.

OSSRH (oss.sonatype.org) is decommissioned per https://central.sonatype.org/pages/ossrh-eol/; this mirrors the migration applied in adobe/aem-core-wcm-components#2977.

The Release workflow on release/57 has been failing with 401 Unauthorized against https://oss.sonatype.org/ (run). A parallel cherry-pick of this commit has been opened against release/57 to unblock the v57 release.

Important

Requires the org-level secrets MAVEN_CENTRAL_USERNAME and MAVEN_CENTRAL_PASSWORD to be populated with valid Central Portal user-tokens for the com.adobe.aem namespace before this can publish successfully.

Test plan

• Confirm MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD org secrets exist (with OSPO)
• Trigger the Release workflow on release/57 (after the companion PR is merged) and verify deploy to central.sonatype.com succeeds

[bpauli]

Updated to reuse the existing org-level SONATYPE_USERNAME/SONATYPE_PASSWORD secrets — verified that MAVEN_CENTRAL_USERNAME/MAVEN_CENTRAL_PASSWORD are not configured at repo or org level. The secret name is just a label; the value behind SONATYPE_PASSWORD is a Central Portal user-token (Sonatype carried these over from OSSRH automatically). Maven server id stays central to match publishingServerId in pom.xml.

Warning

Per the open-source guild Slack thread, the com.adobe.aem namespace was removed from the org's Central Portal account during the OSSRH migration and OSPO is still working on re-attaching it. Even with valid credentials this will 401 until that's done — confirm with @bscott before triggering the v58 release.