test(sprint-11): centralize JaCoCo coverage rules and add bank import + finance test coverage

- pom.xml: introduce risk-tiered JaCoCo rules in parent POM
  - bundle: 80% line coverage
  - bankimport/finance packages: 90% (highest precision)
  - api.security: 85%
  - scheduler/notification: 70%
  - exclude entity/enums/dto/config from coverage measurement
  - add Surefire 3.5.2 plugin management
- cannamanage-service/pom.xml: remove obsolete module-local ComplianceService=100% rule
  (subsumed by parent package rules), add explicit jackson-databind dep so
  ByteBuddy can mock AuditService.METADATA_MAPPER
- Add AbstractServiceTest base class for service-layer tests
- Add FinanceServiceTest
- Add bankimport test suite:
  - Mt940ParserTest with malformed input fixtures
    (encoding, overflow, truncated, generic)
  - PaymentMatchingServiceTest with ParsedTransactionBuilder helper
  - CAMT.053 / Sparkasse MT940 sample fixtures
  - XXE attack fixtures (billion-laughs, SSRF, generic)
- docs/sprint-11/: analysis, plan, plan-review, testplan

cannamanage-service/src/test/resources/bankimport/malformed-encoding.mt940

@@ -0,0 +1,9 @@
+:20:ENCODING-001
+:25:50050201/0001234567
+:28C:00100/001
+:60F:C260601EUR1234,56
+:61:2606010601C50,00NMSCNONREF//B12345
+EREF+M-2025-001
+:86:166?00GUTSCHRIFT?20EREF+M-2025-001?21SVWZ+Müllgebühr Köln Straße?22GRÜNE WIESE GMBH ÄÖÜ?30COBADEFFXXX?31DE89370400440532013000?32Grüne Wiese GmbH
+:62F:C260601EUR1284,56
+-