chroe(deps): replace dependencies without license for Airlock onboarding

[hj690]

Summary

This PR prepares google-cloud-java and java-cloud-bom to build and release using only dependencies from the Airlock trusted Maven repository (maven-3p-trusted).

Changes

1. Replace isorelax:isorelax:20030108 with org.netbeans.external:isorelax:RELEASE310 in 7 internal tooling POMs (java-cloud-bom/{dashboard,libraries-release-data,release-note-generation,tests,tests/validate-bom} and sdk-platform-java/java-shared-dependencies/{dependency-convergence-check,unmanaged-dependency-check}):
   • isorelax:isorelax:20030108 (transitively pulled by com.google.cloud.tools:dependencies) has no license metadata in its POM or source repository.
   • Excludes isorelax:isorelax and replaces it with org.netbeans.external:isorelax:RELEASE310 (MIT license, identical org.iso_relax JARV API, available in maven-3p-trusted).
2. Move clirr-maven-plugin into the clirr-compatibility-check profile in google-auth-library-java/pom.xml:
   • Wraps the clirr-maven-plugin binding in a JDK-activated clirr-compatibility-check profile matching java-shared-config.
   • Keeps CLIRR enabled by default in CI while allowing release scripts (-P=-clirr-compatibility-check) to skip resolving plexus-components:1.1.4 and classworlds:1.1-alpha-2.
3. Pin maven-surefire-plugin:3.5.3 in java-cloud-bom/pom.xml and java-cloud-bom/dashboard/pom.xml:
   • Replaces unpinned maven-surefire-plugin:2.17 and inherited 2.22.2 so the java-cloud-bom release build stops pulling classworlds:1.1, classworlds:1.1-alpha-2, and slf4j-api:1.5.6.
4. Remove <module>tests/dependency-convergence</module> from the default java-cloud-bom/pom.xml reactor:
   • Prevents the java-cloud-bom release reactor from resolving every newly published 1P artifact from the same-day release train before Airlock finishes importing them. CI (.kokoro/dashboard.sh) runs dependency-convergence-check separately.
5. Bump libraries-bom to 26.90.0 in java-samples/native-image-sample/pom.xml and java-spanner/samples/snippets/pom.xml:
   • Replaces older libraries-bom imports (26.80.0 and 26.84.0) that pull google-cloud-bom:0.261.0 and 0.265.0 with 26.90.0 (google-cloud-bom:0.271.0, available in maven-3p-trusted).

[gemini-code-assist]

Code Review

This pull request configures the CLIRR plugin within a profile in the Google Auth Library, replaces the unlicensed isorelax dependency with org.netbeans.external:isorelax across several POM files, pins the maven-surefire-plugin to version 3.5.3, and updates the libraries-bom version in samples. Feedback suggests also pinning the maven-failsafe-plugin to the same version (3.5.3) in both the root and dashboard POMs to avoid potential classpath or test runner conflicts.