Fix hermetic sandbox failures with distro-packaged Maven 3.9

Upgrade hermetic-maven-plugin to 0.6.2 so the generated policy follows
symlinks in maven.home (Debian's Maven package is a symlink farm, which
broke the forked Maven in the wsdl2java-maven-plugin ITs under JDK 8's
canonicalizing FilePermission checks). Also add a repo-root .mvn
directory so Maven 3.9's upward root-directory search stops inside the
sandboxed subtree instead of failing on /home/.mvn.

Note: hermetic-maven-plugin 0.7.0+ requires Java 11 and cannot be used
while the build runs on a JDK 8 Maven JVM.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>