bump spotbugs (+ maven-plugin) from 3.1.5 to 3.1.6