chore: restore maven-surefire-plugin 3.5.6 [2.41]

[netroms]

Restores maven-surefire-plugin to 3.5.6 on 2.41 (bumped to 3.6.0 in #25143).

Surefire 3.6.0 detects junit:junit on the test classpath (transitive via Testcontainers) and then applies groups/excludedGroups as JUnit 4 category filters instead of JUnit Platform tag filters (JUnitPlatformProvider). Our @Tags are ignored, so since #25143 on 2.41:

• unit-test runs all Postgres/H2 integration tests (~30 min, times out in EventAnalyticsServiceTest, e.g. fix: Skip undeletable users when removing expired invitations [DHIS2-22156] (2.41) #25379, fix: Clear invitation state when an invited user gets a password or logs in [DHIS2-22174] (2.41) #25384, chore: replace MinIO with SeaweedFS in tests [2.41] #25395)
• integration-test and integration-h2-test run 0 tests and pass

2.42 and 2.43 are on 3.5.6 (the 2.42 bump #25093 was closed, the 2.43 bump #25191 is red). The dependabot 3.6.0 bump for 2.41 should be closed when it reopens.

AI Assisted

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[netroms]

CI here: tag selection is fixed (integration-test runs 505 + 3171 tests again, h2 1540, unit-test 8m44s). The remaining red is 2.41's MinIO test setup (18 AppManagerMinIOTest errors, MinIO image pull unauthorized in api-test), which #25395 fixes. With both PRs combined, every check is green: #25398 (run 36258546394). #25395 has the mirror problem: its unit-test fails only because of the Surefire tag bug fixed here. One of them has to merge first.

[netroms]

Folded into #25395 (commit 66dc87a), since neither PR is green on its own.