Lock down Maven plugin versions for build reproducibility

This means that the build guys must now follow http://news.gmane.org/gmane.comp.apache.maven.announce to update the plugin version when new version come out (after they've been tested to work).