Fix enforcer use

Enforcer is currently completely within <plugin> while it should be within <pluginMgmt>, to allow downstream overrides, like version upgrade.

Current situation does not allow that, basically loosing all the benefit of having enforcer is pluginMgmt, as downstream project must copy+paste the whole thing.