Pin maven version on GitHub action

[philsmart]

actions/setup-java uses the latest Maven version. It does not appear to have a setting to pin this to a specific version (they have an issue about this actions/setup-java#40). In reality, they say it uses whichever version is installed on the runner (not sure how to control that).

There are other 'setup-maven' type actions on the marketplace which may allow this. Although I am a bit cautious about using a random user's GitHub action over a more standard pipeline using the official GitHub actions.

We should look to try and control this perhaps. Needs investigation.

[iay]

This sounds like it would be important, and I would be a little surprised if there wasn't a way to do it.

On the other hand, if there isn't then I think it's a limitation that we can accept, rather than (e.g.) moving heaven and earth to install a specific, pinned, version of Maven. Most of the variability comes from the plugins, and we pin all the ones we think are significant in the POM (and parent POMs). So changes in the version of the Maven engine shouldn't affect us, and if they do we probably have something that should be corrected. Maven has historically been fairly good about pointing things like this out.

So yes, you should look into this but if it turns out to be anything but trivial, I'm happy to just close this without action.