Retire or modernize the legacy Maven site and reporting stack

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The review found mvn site failing in the legacy Site/Reflow/Doxia stack. The root POM retains Maven Site 3.4, Reflow tools 1.1.1, Velocity 1.7, Doxia Markdown 1.6, and older report plugins including FindBugs.

The reviewed gh-pages branch is a redirect to the OWASP project page, so a maintained source/site publishing requirement should be established before upgrading the entire stack.

Acceptance criteria

• Inventory which generated pages and reports are still consumed, and make an explicit retain-versus-retire decision.
• If retiring: remove unused site/report configuration and dependencies, preserve valuable documentation, and document the canonical OWASP/Javadoc destinations.
• If retaining: update the stack coherently and demonstrate a clean mvn site build on the supported toolchain.
• Review obsolete reports (including FindBugs) and either replace them with maintained analysis or explicitly retire them; coordinate with security CI to avoid redundant tooling.
• Preserve attached sources/Javadocs, release metadata, existing useful links, and ordinary clean verify behavior.
• Update contributor documentation so it no longer advertises a broken or unused workflow.

Do not delete hosted content or alter the live redirect without a separate maintainer-approved publishing step.

Start with the root POM and the reviewed gh-pages branch, then run mvn site and clean verify on the supported toolchain. Inventory generated pages, reports, dependencies, attached sources/Javadocs, release metadata, and contributor documentation. Done means a documented retain-or-retire decision, preserved useful destinations and behavior, and maintainer-approved handling of hosted content and redirects.