Cactus RAT report - where to add plugin in pom.xml?

The RAT report does not seem to be found if I run

mvn rat:check

This seems to be because its plugin is under <pluginManagement> rather
than under <build>, as it works when I moved it there.

But I don't know much about Maven, so maybe it needs to be in both?
If so, does the config need to be in both?

Can anyone advise?

Once it's in the correct place(s), there are some exceptions that need
to be added, e.g. MANIFEST.MF. I can add those.