Update master branch protection required checks after CI workflow rewrite

[raleigh-g-thompson]

Context

PR #141 rewrote the CI workflows:

• Deleted .github/workflows/check-pr.yaml and .github/workflows/spotless.yaml
• Rewrote .github/workflows/ci.yml — the workflow now produces these checks:
  • maven (ubuntu-latest)
  • maven (macos-latest)
  • maven (windows-latest)
  • format (runs ./mvnw spotless:check)
  • verify-changelog (validates CHANGELOG.md against the current pom.xml version)

Problem

The master branch protection rule still lists only the legacy required checks:

• maven (ubuntu-latest)
• maven (windows-latest)

As a result:

• format and verify-changelog run on every PR but cannot block merge, even on
  failure. A PR with malformed spotless or a missing CHANGELOG entry will still be
  mergeable.
• maven (macos-latest) is also advisory only.

The matrix job was deliberately renamed from test back to maven in PR #141 so the
two existing required checks keep matching — without that rename the PR would have been
stuck on "Waiting for status to be reported" for maven (ubuntu-latest) and
maven (windows-latest). The rename was the only self-service fix available without
repo admin access.

Requested change

Update the master branch protection rule's Require status checks to pass before
merging list to:

• maven (ubuntu-latest)
• maven (macos-latest)
• maven (windows-latest)
• format
• verify-changelog

Needs repo admin on cqframework/cql-language-server.

Follow-up: rename maven (*) → test (*)

Once branch protection can be edited, the matrix job should be renamed back from
maven to test in .github/workflows/ci.yml. The maven name was kept only to
match the legacy required-checks list; test better reflects intent (the job runs
the test suite — it doesn't speak to the build tool, which is also subject to change
as the project moves toward Kotlin / Gradle / KMP per the 2026 roadmap).

The rename is a one-line change in ci.yml, but it must be coordinated with the
branch protection update so the new test (*) names land in the required-checks
list at the same time the workflow starts emitting them — otherwise PRs will stall
again on "Waiting for status to be reported."

Verification

After saving, the next PR opened against master should show the "Required" badge next
to all listed checks, and a failing format or verify-changelog should block the
merge button.