Add full Java 8 support: publish target, Java 8-safe crypto, CI matrix

[oleksandrlazarenko-pi]

Brings full Java 8 support to owid-java: the published library targets Java 8, signing/verifying works on a Java 8 runtime, and CI now proves it across a JDK matrix.

This branch was cut from a fork main that already carried the earlier Java 8 work, so against this repo's main it bundles three related changes. It therefore supersedes #1 (Java 8 baseline) and #2 (Java 8 crypto fix) — it contains both, plus a new CI matrix — and those can be closed in favour of this one.

Motivation

owid-java is consumed by SDKs on a Java 8 floor (e.g. 51Degrees pipeline-java). The library must both compile to Java 8 bytecode and actually sign/verify at runtime on a Java 8 JVM. Previously neither the crypto nor the CI guaranteed that.

Changes

1. Target Java 8 for the published library

• maven.compiler.release set to 8, so the shipped owid jar is Java 8 bytecode (major 52).
• Io.java: replaced ByteArrayOutputStream.writeBytes(byte[]) (Java 11) with write(b, 0, len) (Java 8) — the only Java 9+ API in the main sources.

2. Java 8-safe signing / verifying (Crypto.java)

• Replaced SHA256withECDSAinP1363Format (added to the JDK only in Java 15) with the standard SHA256withECDSA, converting between ASN.1 DER and the raw 64-byte (IEEE P1363) form in code.
• Wire format unchanged — the emitted signature is still the raw 32-byte r followed by the 32-byte s.
• Without this, any consumer on Java 8–14 hit NoSuchAlgorithmException: SHA256withECDSAinP1363Format Signature not available the moment they signed or verified.

3. Java 8 CI matrix (+ Java 8-compatible tests)

• ci.yml: the test job now runs on Java 8, 11, 17, 21 (× ubuntu/windows), so the Java 8 runtime contract is verified rather than assumed.
• Made the test sources Java 8-compatible so the whole suite runs on the Java 8 JVM: pom.xml compiles tests at release 8; List.of(...) → Collections.singletonList(...); the record Fixtures → a plain final class (same accessor names, so call sites are unchanged).
• This is precisely what would have caught the crypto issue in change 2: it was a runtime-only failure (a provider/algorithm lookup), invisible to a compile-time check and to a Java 21-only CI.

Compatibility

• Wire format and public API unchanged. The cross-language fixtures (FixturesTest, WireVectorsTest) confirm byte-for-byte interop with owid-js / owid-php / owid-python / owid-dotnet and pass unchanged.

Testing

• mvn clean test — 35/35 pass; test and main class files confirmed major 52 (Java 8).
• Downstream 51Degrees pipeline.did (Java) builds and passes 32/32 against this library, with its animal-sniffer java18 API check green.