chore: upgrade Scala Native to 0.5.12

[He-Pin]

Motivation:
Upgrade the Scala Native baseline to 0.5.12 so follow-up native profiling, async-profiler work, and compatibility work use the latest released 0.5.x toolchain.

Key Design Decision:
Keep this PR focused on the toolchain migration and API cleanup enabled by that migration. The root sbt files were checked: build.sbt is JVM-only for this repository and project/plugins.sbt only adds JMH, so there is no Scala Native sbt plugin version to update here.

Modification:

• Bump scalaNativeVersion from 0.5.11 to 0.5.12 in build.mill.
• Use java.util.HexFormat in the Scala Native platform hash implementation now that Scala Native 0.5.12 provides it.
• Remove the native-only hand-written byte-to-hex helper.
• Allow fork PR CI to use Google Maven Central mirror fallback when no Databricks JFrog OIDC token is available. This is needed because newly released public artifacts, such as Scala Native 0.5.12 modules, may not be mirrored in JFrog yet, and it avoids the Maven Central repo1 TLS failure seen in CI by switching both coursier and the Mill launcher to maven-central.storage-download.googleapis.com.

Benchmark Results:
Not included for this dependency upgrade. This PR establishes the 0.5.12 baseline; follow-up optimization PRs should benchmark their own performance deltas on top of this version.

Analysis:
Scala Native 0.5.12 includes release GC reliability fixes, codegen/toolchain improvements, and Java 17 HexFormat support. The HexFormat change makes the native hash path match the JVM implementation more closely and reduces platform-specific code without changing Jsonnet semantics. The CI repository fallback keeps authenticated Databricks JFrog usage for trusted runs. For fork PRs without OIDC credentials, it uses the Google Maven Central mirror fallback and forces the Mill JVM launcher (MILL_VERSION=<version>-jvm) because the native Mill launcher failed Java TLS handshakes to HTTPS Maven Central mirrors before reaching project dependency resolution. In dummy-token mode it also injects --no-server.

References:

• https://github.com/scala-native/scala-native/releases/tag/v0.5.12

Result:

• ./mill 'sjsonnet.jvm[3.3.7].test' passed.
• ./mill 'sjsonnet.native[3.3.7].nativeLink' passed.
• ./mill __.reformat && ./mill --no-server --ticker false --color false -j 1 __.test passed 444/444 before the HexFormat cleanup.
• ./mill __.reformat && ./mill 'sjsonnet.native[3.3.7].test' passed 457/457 after the HexFormat cleanup.
• bash -n .github/scripts/fix-build-config.sh passed.
• The dummy-token CI path was smoke-tested locally and writes an sbt repository config with local + google-maven-central: https://maven-central.storage-download.googleapis.com/maven2/, exports COURSIER_REPOSITORIES=https://maven-central.storage-download.googleapis.com/maven2/, rewrites the Mill launcher URL to the same mirror, sets MILL_VERSION=1.1.5-jvm, injects --no-server, and appends Java TLS/IPv4 options for public mirror access.