fix(security): upgrade Spring dependency baseline

[Dhi13man]

Why

The default branch has three high-severity Dependabot alerts in Spring Boot and Hibernate. The
affected Spring Boot 2.7 and Hibernate 5 lines do not have patched releases for every advisory, so
keeping those baselines cannot close the alerts honestly.

This change moves the build to the supported Spring Boot 3.5 line and Java 17, then imports Spring
Boot's dependency BOM so Spring Data, Hibernate, JUnit, Mockito, and H2 stay mutually compatible.
It also replaces the obsolete test runner and makes Maven fail when it discovers no tests. Without
that guard, the first migration attempt exited successfully while silently running zero tests.

Changes

• Upgrade Spring Boot from 2.7.18 to 3.5.16 and Hibernate from 5.6.15.Final to the BOM-managed
  6.6.53.Final release.
• Import spring-boot-dependencies instead of independently pinning related framework and test
  dependencies.
• Compile with Java 17 using Maven Compiler Plugin 3.14.1.
• Run JUnit through Maven Surefire 3.5.5 and fail the build if no tests are discovered.
• Replace the duplicated CI package/test commands with one full Maven verify on Java 17.

Test plan

• mvn --batch-mode --no-transfer-progress -Dgpg.skip=true clean verify: 25 tests passed,
  with zero failures, errors, or skips; JAR, sources, and Javadocs were built.
• mvn --batch-mode --no-transfer-progress dependency:tree: resolved Spring Boot 3.5.16,
  Spring Data JPA 3.5.13, Hibernate 6.6.53.Final, and aligned JUnit 5.12.2 artifacts.
• actionlint: workflow syntax and action expressions passed.
• gitleaks detect --no-git --source .: no secrets found.
• git diff --check: no whitespace errors.
• De-bloat scan: no register hits.
• Exact-head GitHub Actions and security checks pass.
• Default-branch Dependabot alerts close after merge.

Local verify skips only GPG signing because the release key is intentionally unavailable in this
workspace. Compilation, test discovery, all 25 tests, packaging, source JAR, and Javadocs still run.

Trade-offs

This intentionally raises the minimum runtime baseline to Java 17 and Spring Boot 3.5. That is a
breaking compatibility boundary for Spring Boot 2.x consumers, but those end-of-life dependency
lines cannot satisfy the current security advisories. Production source code and generated public
API shapes are unchanged; the existing generator tests compile generated configurations and invoke
their data source, entity-manager-factory, and transaction-manager paths against the new stack.

How to review

1. Review pom.xml dependency management first: the BOM should be the only source of versions for
   the Spring, Hibernate, and managed test dependencies.
2. Review .github/workflows/maven.yml: Java 17 must match the POM and the single verify command
   must retain the complete build/test/package gate while skipping only local release signing.
3. Inspect the exact-head CI test count and dependency graph to confirm that all 25 tests execute and
   the three vulnerable default-branch dependency lines are absent.