Removed gpg plugin from topmost <build>

I'm not 100% sure about this one, but I've never seen a project use the gpg-plugin outside of an actual release.

I noticed because I was asked to sign the JAR during a `mvn install`, which doesn't seem necessary.

As a side note, you might consider using sonatype's OSS parent POM, which handles a bunch of boilerplate.