hi there!
I added a plugin execution to run in the validation phase of each module in the project.
The plugin sorts the pom.xml files inplace.
https://github.com/Ekryd/sortpom

I notice you've got a few security plugins, and maybe you're concerned and don't have the patience for validating a large change like this. In that case you could simply copy the plugin into your parent pom and run mvn validate. The committed changes should match exactly.

I'd like to make further PRs on the back of this foundation. Are you open to making JDK11 your base version? It would simplify the errorprone configuration for one.