[CI] Use Develocity cache node for the remote Gradle build cache

[clayburn]

Addresses INFRA-28474.

The remote Gradle build cache at beam-cache.apache.org has been returning 403 Forbidden since its credentials were revoked, so CI builds get no remote cache hits. That cache is a Develocity Build Cache Node, which is reaching end of life, so rather than restore its credentials this PR moves the remote cache to the Develocity build cache connector. Builds then use the built-in Edge node of develocity.apache.org, the same server Beam already publishes Build Scans to under the beam project.

Changes

settings.gradle.kts

• Replace the HttpBuildCache pointing at beam-cache.apache.org with remote(develocity.buildCache).
• Reads: enabled for every build, including pull requests and local builds. The cache on develocity.apache.org is anonymously readable, so no credentials are needed.
• Writes: only CI push and schedule runs that have a Develocity access key. This keeps the rule from [CI] Make Gradle caches read-only for untrusted presubmit workflow runs #40358 that unmerged code never writes to the remote cache.
• Remove Jenkins detection, since Beam CI no longer runs on Jenkins.

Workflows (308 files, mechanical)

• DEVELOCITY_ACCESS_KEY now comes from the BEAM_DEVELOCITY_ACCESS_KEY secret that Apache Infra created for the beam project.
• Remove GRADLE_ENTERPRISE_CACHE_USERNAME/GRADLE_ENTERPRISE_CACHE_PASSWORD. The GE_CACHE_USERNAME and GE_CACHE_PASSWORD secrets are no longer used and can be deleted.

Security

• No workflow that receives the secret is triggered by pull_request_target or issue_comment, and fork PRs do not receive secrets, so untrusted code never sees the key.
• The key goes only to builds of trusted code, and isPush further limits those builds to writing to the cache only on push and schedule events.

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• If this contribution is large, please file an Apache Individual Contributor License Agreement. (Not large: one settings change plus a mechanical secret rename.)
• Replace these instructions with a description of your change and why you have made it.
• Mention the appropriate issue in your description (for example: addresses #123 or fixes #456).
• Update CHANGES.md with noteworthy changes. (CI-only change with no user-facing impact.)

See CONTRIBUTING.md for more details.

[Abacn]

Thanks! Just had one question.

[Abacn]

Is isEnabled = true intended, or shall we enable remote cache only for isCI?

I see the description,

Reads: enabled for every build, including pull requests and local builds. The cache on develocity.apache.org is anonymously readable, so no credentials are needed.

Previously remote cache isn't enabled in release candidate builds (https://github.com/apache/beam/blob/master/.github/workflows/build_release_candidate.yml), as it's supposed to start with a fresh build. We can follow up later.

[clayburn]

We recommend enable build cache reads all builds, but only writing from CI. For develocity.apache.org, reads are anonymous, so setting this to true allows contributors to benefit from remote cache reads.

That said, it is configurable if you prefer only CI.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.82%. Comparing base (76f6e6d) to head (b582f37).
⚠️ Report is 149 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master   #40551       +/-   ##
=============================================
+ Coverage     56.16%   75.82%   +19.65%     
  Complexity     2288     2288               
=============================================
  Files          1124      259      -865     
  Lines        178336    14459   -163877     
  Branches       1489     1487        -2     
=============================================
- Hits         100170    10964    -89206     
+ Misses        75645     2792    -72853     
+ Partials       2521      703     -1818     

Flag	Coverage Δ
go	?
java	75.82% <ø> (+0.04%)	⬆️
python	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers