chore(build): drop dependency-check binding from verify (RAN-24 review)

Per reviewer feedback on #72: the OWASP dependency-check binding added in
15b5e6c red-lines every CI run because the public NVD 2.0 API rate-limits
anonymous callers (HTTP 429), which corrupts the partial H2 NVD store and
trips NPEs in the plugin's worker pool. Root cause is infra, not a real
CVE finding, but the failing binding still breaks the build - the opposite
of "CI enforces them."

Path B (reviewer's recommendation): keep the SpotBugs binding (already
green on this branch), drop the dep-check binding + skip property from
this PR, and track the NVD secret + cache work in a follow-up.

Removes from pom.xml:
  - `<dependency-check.skip>` property and comment
  - `<configuration>` + `<executions>` blocks on dependency-check-maven
    (the plugin declaration itself stays for the follow-up to re-enable)

Updates .github/workflows/ci-java.yml comment to reference only the
SpotBugs gate.

Keeps dependency-check-suppressions.xml so the next PR can turn the gate
on without re-introducing the stub.

Verified locally (`mvn -B clean compile spotbugs:check ...`):
  [INFO] --- spotbugs-maven-plugin:4.9.8.3:check (default-cli) @ code-iq ---
  [INFO] BugInstance size is 0
  [INFO] BUILD SUCCESS

Full `mvn clean verify` on this branch pre-edits produced
`Tests run: 3395, Failures: 0, Errors: 0, Skipped: 31` before the dep-check
step failed (per CI run 24913046002); removing that step is the only CI
delta this commit introduces.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: aksOps

.github/workflows/ci-java.yml

@@ -19,8 +19,8 @@ jobs:
           java-version: '25'
           cache: 'maven'
       # `verify` is the enforced quality gate: it runs unit + integration tests
-      # AND the spotbugs:check + dependency-check:check executions bound in pom.xml.
-      # Any of those failing breaks the build.
+      # AND the spotbugs:check execution bound in pom.xml. Any of those
+      # failing breaks the build.
       - run: mvn clean verify -B
       - uses: actions/upload-artifact@v4
         if: always()

pom.xml

@@ -30,14 +30,6 @@
         <owasp.dependency-check.version>12.2.0</owasp.dependency-check.version>
         <checkstyle-plugin.version>3.6.0</checkstyle-plugin.version>
 
-        <!--
-          Toggle for the OWASP dependency-check execution bound to `verify`.
-          Default: false (gate runs in CI). Override locally with
-          `-Ddependency-check.skip=true` since the first run downloads the
-          NVD database (~1GB).
-        -->
-        <dependency-check.skip>false</dependency-check.skip>
-
         <!--
           Security override: Spring Boot 4.0.5 pulls tomcat-embed-core 11.0.20
           and jackson (tools.jackson.core) 3.1.0; both have CVEs fixed in the
@@ -423,20 +415,6 @@
                 <groupId>org.owasp</groupId>
                 <artifactId>dependency-check-maven</artifactId>
                 <version>${owasp.dependency-check.version}</version>
-                <configuration>
-                    <skip>${dependency-check.skip}</skip>
-                    <failBuildOnCVSS>7</failBuildOnCVSS>
-                    <suppressionFiles>
-                        <suppressionFile>dependency-check-suppressions.xml</suppressionFile>
-                    </suppressionFiles>
-                </configuration>
-                <executions>
-                    <execution>
-                        <id>dependency-check-verify</id>
-                        <phase>verify</phase>
-                        <goals><goal>check</goal></goals>
-                    </execution>
-                </executions>
             </plugin>
 
             <plugin>