fix(deps): use javax.jdo:jdo2-api 2.3-eb, which has a license in its POM

[hj690]

Context

MOSS requires that our builds use Airlock. The goal is to pull all third-party dependencies only from Airlock, which is the trusted source. This PR fixes the same blocker that b/573257533 reports for google-oauth-java-client.

Problem

• The parent pom.xml manages javax.jdo:jdo2-api:2.3-20090302111651 in dependencyManagement. No module declares jdo2-api today. But dependency scans can still see the managed version, and any module that adds jdo2-api gets this version.
• Airlock does not validate this version because of a license issue. MOSS reports "NO VALID LICENSE", because the published POM has no <licenses> block.
• This version came from Renovate in chore(deps): update dependency javax.jdo:jdo2-api to v2.3-20090302111651 #1952.
• The Renovate change was not a real upgrade. Maven ranks a numeric qualifier above a text qualifier, so 20090302111651 sorts after eb. But the 20090302111651 jar is older. Its manifest dates it to 2008-12-28 and says Implementation-Version: 2.3-SNAPSHOT. The 2.3-eb jar dates from January 2010.

Fix

This PR replaces the dependency with javax.jdo:jdo2-api:2.3-eb. Airlock validates this version (it is in maven-3p-trusted), and its POM declares Apache 2.0.

• pom.xml: set project.jdo2-api.version to 2.3-eb.
• renovate.json: disable Renovate updates for javax.jdo:jdo2-api, so that Renovate does not open chore(deps): update dependency javax.jdo:jdo2-api to v2.3-20090302111651 #1952 again.

Testing and verification

Why I think this change is safe:

• No module in this repo uses jdo2-api, so the change does not affect any published module.
• The Java package (javax.jdo) and the artifactId do not change.
• googleapis/google-oauth-java-client makes the same change. In that repo, the JDO classes build and pass tests with 2.3-eb, and the enhanced bytecode is byte-identical.

Tests I did:

• mvn validate passes.
• The effective parent POM manages jdo2-api at 2.3-eb.

[hj690]

This is prob not necessary as I revisit, closing for now.