Retire or modernize the legacy Maven site and reporting stack

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The review found mvn site failing in the legacy Site/Reflow/Doxia stack. The root POM retains Maven Site 3.4, Reflow tools 1.1.1, Velocity 1.7, Doxia Markdown 1.6, and older report plugins including FindBugs.

The reviewed gh-pages branch is a redirect to the OWASP project page, so a maintained source/site publishing requirement should be established before upgrading the entire stack.

Acceptance criteria

• Inventory which generated pages and reports are still consumed, and make an explicit retain-versus-retire decision.
• If retiring: remove unused site/report configuration and dependencies, preserve valuable documentation, and document the canonical OWASP/Javadoc destinations.
• If retaining: update the stack coherently and demonstrate a clean mvn site build on the supported toolchain.
• Review obsolete reports (including FindBugs) and either replace them with maintained analysis or explicitly retire them; coordinate with security CI to avoid redundant tooling.
• Preserve attached sources/Javadocs, release metadata, existing useful links, and ordinary clean verify behavior.
• Update contributor documentation so it no longer advertises a broken or unused workflow.

Do not delete hosted content or alter the live redirect without a separate maintainer-approved publishing step.

Comienza con el POM raíz y la rama gh-pages revisada, y después ejecuta mvn site y clean verify en la toolchain compatible. Haz un inventario de las páginas generadas, los informes, las dependencias, las fuentes/Javadocs adjuntos, los metadatos de release y la documentación para contribuidores. Se considera terminado cuando exista una decisión documentada de conservar o retirar, se mantengan los destinos y comportamientos útiles, y los maintainers hayan aprobado cómo gestionar el contenido alojado y las redirecciones.