[SPARK-42382][BUILD] Upgrade cyclonedx-maven-plugin to 2.7.6

[dongjoon-hyun]

What changes were proposed in this pull request?

This pr aims upgrade cyclonedx-maven-plugin to 2.7.6 for Apache Spark 3.5.0.

Why are the changes needed?

The release notes as follows:

• https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.4
• https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.5
• https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.6

Does this PR introduce any user-facing change?

No

How was this patch tested?

• Pass GitHub Actions.
• Manual check the cyclonedx.xml file can be generated normally.

[dongjoon-hyun]

Hi, @LuciferYang .
Since you've been investigating this so far, I made a PR with your main-authorship.

[dongjoon-hyun]

R failure on AppVeyor is irrelevant to this PR.

[dongjoon-hyun]

Could you review this PR, @viirya ? I verified manually.

$ ls -alt
total 67688
-rw-r--r--@  1 dongjoon  staff      1955 Apr 10 15:27 maven-metadata-local.xml
-rw-r--r--@  1 dongjoon  staff       492 Apr 10 15:27 _remote.repositories
-rw-r--r--@  1 dongjoon  staff   4451845 Apr 10 15:27 spark-core_2.12-3.5.0-SNAPSHOT-javadoc.jar
-rw-r--r--@  1 dongjoon  staff    362584 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT-cyclonedx.json
-rw-r--r--@  1 dongjoon  staff    312338 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT-cyclonedx.xml
-rw-r--r--@  1 dongjoon  staff   1423015 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT-test-sources.jar
-rw-r--r--@  1 dongjoon  staff   2919170 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT-sources.jar
-rw-r--r--@  1 dongjoon  staff   8078262 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT-tests.jar
-rw-r--r--@  1 dongjoon  staff  14038165 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT.jar
-rw-r--r--@  1 dongjoon  staff     44355 Apr 10 15:26 spark-core_2.12-3.5.0-SNAPSHOT.pom
drwxr-xr-x@  4 dongjoon  staff       128 Apr 10 14:56 ..
drwxr-xr-x@ 12 dongjoon  staff       384 Apr 10 14:56 .

$ head spark-core_2.12-3.5.0-SNAPSHOT-cyclonedx.xml
<?xml version="1.0" encoding="UTF-8"?>
<bom serialNumber="urn:uuid:14185927-0ca0-4589-92aa-268c9c81873d" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
  <metadata>
    <timestamp>2023-04-10T22:26:52Z</timestamp>
    <tools>
      <tool>
        <vendor>OWASP Foundation</vendor>
        <name>CycloneDX Maven plugin makeBom compile+provided+runtime+system</name>
        <version>2.7.6</version>
        <hashes>

[HyukjinKwon]

Merged to master.

[HyukjinKwon]

Hm, for some reasons, it shows @LuciferYang as a primary author. I manually changed it to @dongjoon-hyun.

[dongjoon-hyun]

Oh, it was intentional #40726 (review), but thank you!

Thank you, @HyukjinKwon and @viirya !

[LuciferYang]

late LGTM ~ Thanks @dongjoon-hyun and all ~

[steveloughran]

this working OK on the latest maven releases that homebrew is pushing out?

[dongjoon-hyun]

To @steveloughran , this is done independently from Maven.
I verified in Apache ORC and Spark community only for now.