chore(build): prepare shared validation tools

[imbajin]

Purpose of the PR

Prepare shared build and server-fixture tooling for the Java 17 migration while retaining the existing Java bytecode baseline. This PR does not perform the global Java 17 switch.

Related migration discussion: apache/hugegraph#3242.
Original preparation and review: hugegraph#40.

Main Changes

• Verify cached server archives against repository, commit and SHA-256 while preserving the exact custom cache directory. Reject unknown or mismatched caches without deleting them; version the Loader CI cache key so the first use builds a verified cache.
• Centralize compiler, test and coverage versions compatible with the existing modules.
• Carry the selected server repository, ref and expected commit through CI, and verify checkout provenance.
• Build server fixtures outside the source workspace without replacing published Maven dependencies; share authenticated HTTP/HTTPS startup.
• Preserve Loader distribution caching and report missing or ambiguous archives before startup.

Verifying these changes

The cache regression checks use local Git and mocked build/startup fixtures; no additional backend test is required.

• Trivial rework / code cleanup without any test coverage.
• Already covered by server-selection, checkout and installer contract tests.
• Need tests and can be verified as follows:
  • Installer fixtures and shell/workflow checks passed locally.
  • JDK 11 preparation validation used released dependencies; the latest archive-diagnostic regression passed.
  • Current-head organization CI is still running/queued; upstream checks will run separately.

Does this PR potentially affect the following parts?

• Nope
• Dependencies (build/test tooling only; runtime payload is unchanged by this preparation)
• Modify configurations (CI/test configuration)
• The public API (compatible behavior; signatures unchanged)
• Other affects: tests and validation tooling

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.95%. Comparing base (b066b80) to head (4c737ff).
⚠️ Report is 244 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master     #775       +/-   ##
=============================================
- Coverage     62.49%   45.95%   -16.55%     
- Complexity     1903     4386     +2483     
=============================================
  Files           262      602      +340     
  Lines          9541    29361    +19820     
  Branches        886     3432     +2546     
=============================================
+ Hits           5963    13492     +7529     
- Misses         3190    14549    +11359     
- Partials        388     1320      +932     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bitflicker64]

Blocking: no. Summary: Score 9/10. The server selection, verified checkout, shared HTTP/HTTPS startup and provenance-checked Loader cache behave as described, and the Mockito 4 and plugin-version changes keep every existing test suite running. Evidence: full exact-head diff review of 4c737ff in a dedicated worktree; node --test of resolve, checkout-server and install-server contract tests (25/25 pass); no Mockito APIs removed in v4 remain; CI test totals at head match the latest master runs (loader 11/98/103/4/6, hubble 598, client 72/376/102, tools 18, spark 47); all workflows pass at head. codecov/project fails against a base 244 commits behind master, with the same drop on #776, #778 and #779, so it is not caused by this change.