[FLINK-39654][build] Add JDK 25 CI test lane (non-blocking)

[jackylee-ch]

What is the purpose of the change

Add a non-blocking JDK 25 CI test lane to provide continuous visibility into JDK 25 readiness, building on FLINK-38474 (java25-target profile) and the compilation fixes already resolved under FLINK-37719.

This follows the same incremental approach used for JDK 17 (FLINK-15736) and JDK 21 (FLINK-33163) support.

Brief change log

• Install Zulu JDK 25 in job_init action (GHA runners only ship JDK 17/21)
• Add parallel JDK 25 lane in ci.yml with continue-on-error: true
• Add workflow-caller-id to disambiguate JDK 17 vs JDK 25 build artifacts
• Add target.java.version=25 and spotless.skip=true to java25-target profile
• Bound -Djava.security.manager=allow to JDK 18–23 in surefire profiles and config.sh (JEP-486 permanently removes SecurityManager in JDK 24+)

Verifying this change

This change is already covered by existing tests. The CI lane itself is the verification — it will run the full test suite under JDK 25 in non-blocking mode.

Does this pull request potentially affect one of the following parts:

- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no

Documentation

- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable

Was generative AI tooling used to co-author this PR?

co-authed by Claude Code

[flinkbot]

CI report:

• 39a0e2a Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[snuyanzin]

usually this should be the last step once it is ready
for now it can be only compiled, however tests do not pass yet

[snuyanzin]

moreover it doesn't do anything with azure

[jackylee-ch]

usually this should be the last step once it is ready for now it can be only compiled, however tests do not pass yet

Of course, this PR is mainly to show how much work is still needed, and it can remain here until everything is completed.