Fix sar-sample-two and skinny-wars-timestamp ITs on Maven 4 rc-5

[ascheman]

Summary

Two integration tests fail on Maven 4.0.0-rc-5 in PR #499's matrix. This PR
makes them pass with conservative IT-fixture changes only — no production
code touched.

Failure A — skinny-wars-timestamp (invoker IT)

The fixture src/test/resources/m2snapshots/.../maven-metadata.xml has no
.sha1 / .md5 companions. On Maven 4 / Resolver 2.0.13 this trips
ChecksumFailureException for the metadata transfer from the IT's file://
local.snapshot repo; the snapshot version then cannot be resolved and the
build aborts with Missing file: war-module-one-1.0.war.

Fix: add <checksumPolicy>ignore</checksumPolicy> to all <releases> /
<snapshots> blocks in src/it/settings.xml. This is the long-standing
Apache-plugin-IT convention for file:// fixtures (the same line is present
in maven-clean-plugin, maven-compiler-plugin, maven-deploy-plugin,
maven-install-plugin, maven-resources-plugin, maven-shade-plugin,
maven-site-plugin, and others).

This is a workaround at the IT-fixture layer. The underlying Resolver
behavior is tracked at apache/maven-resolver#1920 (labeled bug, milestone
2.0.19), so this PR should become unnecessary once Maven 4 picks up that
Resolver release.

Failure B — EarMojoIT.sar-sample-two (failsafe Java IT)

Maven 4 rc-5 picks the baked-in default maven-resources-plugin:4.0.0-beta-1
for the test-project default-resources goal, which raises
NoSuchMethodError against the current org.apache.maven.api shape. Local
caches with a 3.x version of the plugin silently mask the failure via Maven
4's "compatibility-failed → look for compatible RELEASE" fallback; pristine
CI environments hit it directly.

Fix: pin maven-resources-plugin via the existing @-token
pluginManagement pattern in project-092 / -093 / -094 / -097, with
a new <mavenResourcesPluginVersion> property sourced from apache-parent's
version.maven-resources-plugin. Mirrors what landed for
maven-source-plugin in apache/maven-javadoc-plugin#1332.

Verification

Validated end-to-end on the fork branch
aschemaven/maven-ear-plugin#mvn4-pr499-fail-at-end, which combines
Bukama's #499 (maven4-enabled: true) with this PR's two fixes and
verify-fail-fast: false for full matrix visibility:

CI run	Commit	rc-5 result
27273896660	no fixes	6/6 red
27279805280	Fix B (resources-plugin pin) only	6/6 red — only skinny-wars-timestamp chain left
27283681337	Fix A + Fix B (this PR's content)	6/6 green

This PR's own CI on mvn4-rc5-it-fixes only exercises Maven 3.9.16 because
maven4-enabled defaults to false on master. @Bukama — once #499
merges, please rebase this PR so the upstream matrix surfaces Maven 4 here
directly.

Related

• Enable Maven 4 build #499 (@Bukama) — CI flag flip that surfaces the failures. Recommend
  merging Enable Maven 4 build #499 first, then rebasing here.
• IT "skinny-wars-timestamp" fails on Windows 11 #478 (@cstamas's 2026-01 diagnosis pointed correctly at the Resolver area;
  the mechanism documented above is the refined understanding).
• Pin maven-source-plugin in MJAVADOC-639 IT for Maven 4 compatibility maven-javadoc-plugin#1332 — sibling Maven-4-API-pin fix for
  maven-source-plugin:4.0.0-beta-1.
• WarnChecksumPolicy.onNoMoreChecksums() throws like fail policy on missing checksums maven-resolver#1920 — Resolver bug tracking the underlying behavior
  (milestone 2.0.19).

cc @Bukama @cstamas @hboutemy