feat(java): remove sun.misc.Unsafe for jdk25

[chaokunyang]

Why?

JDK25+ removes the remaining viable sun.misc.Unsafe paths Fory used for Java object creation, field access, string internals, and memory operations. This PR makes the Java runtime continue to support modern JDKs while preserving the existing JDK8-24, Android, GraalVM, native-mode, and xlang behavior where applicable.

What does this PR do?

• Builds fory-core as a multi-release jar with JDK25-specific classes and module metadata, while keeping the root implementation for JDK8-24.
• Replaces the JDK25+ runtime paths for field access, object instantiation, string internals, memory access, and generated serializers with trusted lookup, VarHandle, ReflectionFactory, and other non-Unsafe owners.
• Updates Java serializers, codegen, copy paths, collection/map serializers, object stream handling, and default-value support to use the new accessor and instantiator ownership model.
• Extends CI and integration coverage for JDK25/JDK26, JPMS zero-Unsafe runs, multi-release jar verification, GraalVM packaging, and cross-JDK compatibility expectations.
• Updates Java, Kotlin, Scala, and top-level docs for JDK25+ setup, including the required java.base/java.lang.invoke open for classpath and module-path users.
• Adds Java25 benchmark modules and MR-JAR benchmark verification for direct memory and direct-to-heap copy paths.

Related issues

Closes #3729
Closes #2090
Closes #2606

AI Contribution Checklist

• Substantial AI assistance was used in this PR: yes / no
• If yes, I included a completed AI Contribution Checklist in this PR description and the required AI Usage Disclosure.
• If yes, my PR description includes the required ai_review summary and screenshot evidence of the final clean AI review results from both fresh reviewers on the current PR diff or current HEAD after the latest code changes.

Does this PR introduce any user-facing change?

Yes. Java users on JDK25+ must open java.base/java.lang.invoke to Fory:

• Classpath: --add-opens=java.base/java.lang.invoke=ALL-UNNAMED
• Module path: --add-opens=java.base/java.lang.invoke=org.apache.fory.core

No binary protocol compatibility change is intended.

• Does this PR introduce any public API change?
• Does this PR introduce any binary protocol compatibility change?

Benchmark

This PR adds Java25 benchmark coverage under benchmarks/java25 and a benchmark MR-JAR check. No benchmark result table is included here.