[Maintenance] Fix bc-fips dependency jarhell for maven publish

[RyanL1997]

Description

The FIPS flag (-Pcrypto.standard=FIPS-140-3) was added to plugin_install.yml and scripts/build.sh, but it's missing from maven-publish.yml. This means the published snapshots are still built without the flag, so bc-fips, bcpkix-fips, and bcutil-fips are bundled as implementation instead of compileOnly. This causes jar hell for downstream plugins (like SQL) that download the security snapshot for integration tests, since those jars already exist in OpenSearch core's lib/ directory.

Issues Resolved

• Relate Fix plugin install workflow by adding -Pcrypto.standard=FIPS-140-3 #5962
• Relate [Maintenance] Fix bc-fips jar hell by marking dependency as compileOnly sql#5158

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.