CI: Share Gradle cache and select PR matrices

[ajantha-bhat]

Summary

• add reusable composite actions to prepare and save incremental Gradle build-cache state across CI jobs
• add a shared PR CI planner that uses merge-base changed files, full-ci labels, and global build/workflow changes to select PR matrices
• keep full Java/Spark/Flink/Hive/Kafka/Delta/CVE coverage for main, release branches, tags, full-ci, and global Gradle/workflow changes
• run a primary JVM on ordinary PRs and keep the full Java 17/21 matrix for full CI paths

Selective PR behavior

• Spark-only changes run Spark jobs, not Flink/Hive/Kafka jobs
• spark/v4.1/** selects Spark 4.1 only; spark/v4.0/** and spark/v3.5/** behave similarly
• flink/v2.0/** selects Flink 2.0 only; other versioned Flink paths behave similarly
• API/Core/Data/file-format changes run Java checks plus latest Spark and latest Flink canaries
• runtime/bundle CVE scans are limited to affected runtime artifacts, while dependency/global changes run the full CVE matrix

Rationale

• follows the Project Nessie/Polaris-style Gradle cache approach to reduce repeated Gradle work
• keeps the selective planner small and driven by changed paths plus versions already declared in gradle.properties
• avoids changing Gradle project definitions or adding a new third-party dependency

Validation

• YAML parse for the new composite actions and edited workflows
• git diff --check
• bash -n .github/scripts/plan-pr-ci.sh
• synthetic planner assertions for Spark 4.1, Flink 2.0, core canaries, and full-ci
• ./gradlew -h

[kevinjqliu]

thanks for the PR @ajantha-bhat

i've done some work with gradle cache recently (#16356) and made it so that there's only 1 canonical writer. Before this change, I saw that we were constantly getting thrashed by multiple cache writers and cache utilization was really low.

Theres also a security component to this, we should only write to cache on push to main branch. We should not allow PRs to write to the shared cache since that's a cache poisoning vulnerability.

I'm curious how this change effects when to save to cache and how its reused