Verify the build against Maven 4 as well

[slachiewicz]

Adds maven4-enabled: true, which appends 4.0.0-rc-6 to the existing Maven 3 matrix rather than replacing it — so the plugin keeps being built and tested with Maven 3 and additionally gets verified against Maven 4. The shared workflow also excludes the {jdk: 8, maven: 4.x} cell automatically, since Maven 4 needs JDK 17+.

Part of establishing which Maven 3 plugins already build clean on Maven 4 ahead of the 4.0.0 GA. Same change as apache/maven-javadoc-plugin#1350. Context in apache/maven#12676.

If the Maven 4 cell turns out to fail, that is the useful result — better to know now than at GA.

[slachiewicz]

The Maven 4 leg this enables is red for a reason unrelated to the workflow: sign-release-with-excludes does not know about the build POM that Maven 4 installs next to the consumer POM. #332 fixes the IT; once that lands this should go green on a rerun.

Two other things worth folding in here, from reviewing the run:

• verify-fail-fast: false — the shared workflow defaults it to true, so the single Maven 4 failure cancelled the other 14 legs, including every Maven 3 one. All 15 checks read as failed when only one actually did, which makes it impossible to tell a Maven 4 problem from a Maven 3 regression.
• maven4-version: 4.0.0-rc-6 — without it this tracks the shared workflow's floating default, so a v5 retag can change what is being verified with no commit in this repo.

I can push both to this branch if you would like.