[FLINK-40459][Build/Shaded] Bump Maven from 3.8.6 to 3.9.16

[MartijnVisser]

What

Bump the build and enforced Maven version from 3.8.6 to 3.9.16, matching apache/flink#29009 for FLINK-40459, and add a Maven wrapper so CI and local builds share one pin.

Why

Maven 3.9 renders mojo banners using the plugin's goal prefix (deploy:2.8.2:deploy) instead of its artifactId (maven-deploy-plugin:2.8.2:deploy). flink-ci-tools' DeployParser and DependencyParser match on the artifactId spelling, so under 3.9.16 they match nothing, NoticeFileChecker sees zero deployed modules, and the NOTICE check degrades to a no-op that still exits 0 — a green build that checked nothing:

Build	exit	Extracted N modules that were deployed
3.8.6	0	17
3.9.16, unremediated	0	0
3.9.16 + this PR	0	17

No released flink-ci-tools fixes this — I checked the 1.18.0, 1.20.4 and 2.2.1 jars on Central — so CI rewrites the two affected banners back to the 3.8 spelling before invoking the checker. ShadeParser is unaffected; its regex already starts with .*.

Changes

• .mvn/wrapper/maven-wrapper.properties, mvnw, mvnw.cmd — wrapper pinning Maven 3.9.16 (maven-wrapper 3.3.4), matching Flink's. Added script-only: maven-wrapper.jar is not checked in, so no binary enters the ASF source release; mvnw fetches it on first use and verifies wrapperSha256Sum. The earlier attempt here (0a4baad) checked the jar in and was reverted 18 minutes later.
• .github/workflows/ci.yml — build through ./mvnw, drop the stCarolas/setup-maven step, and normalize the two mojo banners before the license check. The workflow now contains no Maven version at all: maven-wrapper.properties is the single pin. Drop the normalization step once flink-ci-tools ships the FLINK-40459 parser fix.
• pom.xml — the release profile's requireMavenVersion pin [3.8.6] → [3.9.16].
• .gitignore / README.md — ignore the downloaded wrapper jar; document the required Maven version.

Release scripts under tools/releasing/ keep using the system mvn.

Verification

Differential build of the full reactor under both Maven versions, on JDK 11 and 17, across the default, -Pinclude-netty-tcnative-static, -Plicense-check, -Dshade-sources and -Prelease profiles:

• Every deployed artifact is identical entry-for-entry and by SHA-256 per uncompressed entry — META-INF/NOTICE, META-INF/DEPENDENCIES and the dependency-reduced/flattened poms included. The only difference anywhere is the manifest Created-By: Apache Maven 3.8.6 → 3.9.16 and the matching pom.properties comment; the three Ant-repackaged netty/tcnative jars are unchanged, as expected.
• Resolution is unchanged: two independent cold local repositories are identical in all 2189 files, and dependency:tree / dependency:list match exactly.
• Downstream, flink-rpc/flink-rpc-akka built against each artifact set with the same Maven gives uber-jars identical in all 12323 entries.

Per-commit detail, including the old plugin set's behaviour under 3.9.16 and the negative controls, is in the commit message.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Claude Opus 5)