Update maven-publish workflow: surefire & models

Add -Dsurefire.useSystemClassLoader=false to the Maven deploy invocation to avoid Surefire classloader issues during CI runs. Also grant the job read permission for "models" to satisfy workflow permission requirements for the publish job.

Author: mercyblitz

.github/workflows/maven-publish.yml

@@ -51,6 +51,7 @@ jobs:
           --update-snapshots
           --file pom.xml
           -Drevision=${{ inputs.revision }}
+          -Dsurefire.useSystemClassLoader=false
           -Dgpg.skip=true
           deploy
           --activate-profiles publish,ci
@@ -66,6 +67,7 @@ jobs:
     needs: build
     permissions:
       contents: write
+      models: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5