fix: Don't use release profile for phoenix build

[dervoeti]

In this PR I enabled the CycloneDX plugin for the release profile of Phoenix and changed the Maven command to build Phoenix using that profile (because that's how HBase does it as well).

However, the Phoenix release profile also enables the apache-rat-plugin which causes a minor problem with our current build of Phoenix 5.3.0.

Since using the release profile does not seem to have any further advantages I moved the CycloneDX plugin to the general plugin section in the pom.xml and do not activate the release profile anymore when building Phoenix.

Tested the build with Phoenix locally, worked fine and the Phoenix SBOM was still generated correctly.

[razvan]

I just scanned the pom changes briefly but didn't test them. I trust you.

Maybe a less invasive way would be to define our own CycloneDx profile that we enable per command line in addition to the default one. Just an idea.

[dervoeti]

Yeah I like the idea. It's out of scope for this PR, but it might be a way to better separate this custom patch and avoid conflicts with upstream changes. Also it makes it easy to toggle SBOM generation (although I can't think of a case where we don't want SBOMs to be generated). We could improve it at some point, but should do so for all Java products in all versions.