Harden CI: Artifactory OIDC, fork-aware workflows, tightened permissions

[MichaelGHSeg]

Summary

• Add Artifactory OIDC composite action — exchanges GitHub OIDC token for short-lived Artifactory access token, writes `~/.m2/settings.xml` mirroring `virtual-maven-thirdparty`
• Add `ci.yml` — replaces `publish.yaml`, fork-aware runner selection, Java 11/17/21 matrix, spotless + animal-sniffer checks, SHA-pinned actions
• Add `deploy.yml` — tag-triggered, `environment: maven-central` gate, GPG signing, tightened permissions
• Update `e2e-tests.yml` — remove `E2E_TESTS_TOKEN` (sdk-e2e-tests going public), fork-aware

Notes

• Maven Central has no OIDC trusted publishing — GPG signing + Sonatype credentials remain required
• Old `publish.yaml`, `java8.yml`, `java11.yml`, `java17.yml`, `e2e.yaml` can be deleted once new workflows are validated

Test plan

• CI runs on this PR
• Artifactory OIDC exchange succeeds on same-repo CI
• Before merging: set `ARTIFACTORY_URL` repository variable
• Before merging: create `maven-central` GitHub environment with protection rules
• Before merging: migrate GPG + Sonatype credentials to environment-scoped secrets