Declare Sonatype credential origins once setup-java releases support #999

Maven 3.10 warns when the central-portal publishing credentials have no explicitly declared repository origin. It permits authentication for this server ID under its default credential policy, but the credentials should be bound to https://central.sonatype.com so publishing does not rely on that fallback.

Upstream support was merged in actions/setup-java#1282, but is not included in the current v6.0.1 release.

Once this feature is available in a released setup-java version:

• Upgrade actions/setup-java in the snapshot publishing job in .github/workflows/ci.yml and the release job in .github/workflows/release.yml.

• Add the new mvn-server-repository-origins input to both publishing setup steps:

  mvn-server-repository-origins: |
    central-portal:https://central.sonatype.com

• Verify that snapshot publishing succeeds without the unspecified-origin credential warning. Confirm that both publishing workflows generate the explicit origin binding for central-portal.

Keep the existing publishing server ID and GitHub Secrets. Use a released action version; there is no need to patch generated settings or maintain a separate settings file.