Extract caching logic into a separate gradle-actions-caching component (#885)

With this change, the caching functionality of `setup-gradle` and
`dependency-submission` is now provided by `gradle-actions-caching`, a
closed-source library distributed under our [Terms of
Use](https://gradle.com/legal/terms-of-use/). The rest of the action
implementation remains open source.

Using `setup-gradle` or `dependency-submission` with caching enabled
involves loading and using the `gradle-actions-caching` component,
requiring acceptance of the [Terms of
Use](https://gradle.com/legal/terms-of-use/). There are no functional
changes to caching provided by these actions: all workflows will
continue to function as before.

The non-caching aspects of action implementation remain open source. By
running these actions with caching disabled they can be used without
ever loading `gradle-actions-caching` or accepting the license terms.

Supporting the caching infrastructure in this project requires a
substantial engineering investment by Gradle Technologies, which we can
sustain thanks to Develocity, our commercial offering. Caching
technologies are a core part of the Develocity offering, and the caching
in `setup-gradle` fits squarely in that space.

This licensing change lets us continue to build advanced capabilities
that go beyond what we would offer as open source. Proper
production-ready Configuration Cache support will be the first
capability. Improving build performance for self-hosted runners will
follow.

We may introduce functionality restrictions in future updates. However,
caching functionality will remain free for public repositories.
We have a long-standing commitment to open source, as maintainers of
Gradle Build Tool, and by [sponsoring the open source
community](https://gradle.com/oss-sponsored-by-develocity/) with free
Develocity licenses. Public repositories are primarily used by open
source projects, and we remain committed to supporting them.

- Implementation of caching logic to save and restore Gradle User Home
content has been removed, replaced by the `gradle-actions-caching`
component.
- The `@actions/caching` library is still used to cache Gradle
distributions that are downloaded and provisioned by `setup-gradle`.
This PR updates to the latest version of `@actions/caching`, and removes
the patch that is no longer required.
- License notices are now displayed in documentation, logs and the
generated Job Summary.

.github/workflows/ci-ossf-scorecard.yml

@@ -49,9 +49,3 @@ jobs:
           name: SARIF file
           path: results.sarif
           retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard.
-      - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
-        with:
-          sarif_file: results.sarif

.github/workflows/integ-test-cache-cleanup.yml

@@ -41,7 +41,7 @@ jobs:
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build with 3.1
-      working-directory: sources/test/jest/resources/cache-cleanup
+      working-directory: .github/workflow-samples/cache-cleanup
       run: ./gradlew --no-daemon --build-cache -Dcommons_math3_version="3.1" build
 
   # Second build will use the cache from the first build, but cleanup should remove unused artifacts
@@ -67,7 +67,7 @@ jobs:
         cache-read-only: false
         cache-cleanup: 'on-success'
     - name: Build with 3.1.1
-      working-directory: sources/test/jest/resources/cache-cleanup
+      working-directory: .github/workflow-samples/cache-cleanup
       run: ./gradlew --no-daemon --build-cache -Dcommons_math3_version="3.1.1" build
 
   # Third build will restore cache entry from second, and verify stale content removed

.github/workflows/integ-test-wrapper-validation.yml

@@ -111,6 +111,12 @@ jobs:
     steps:
     - name: Checkout sources
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        sparse-checkout: |
+          .github
+          dist
+          wrapper-validation
+
     - name: Initialize integ-test
       uses: ./.github/actions/init-integ-test
 
@@ -118,10 +124,8 @@ jobs:
       id: action-test
       uses: ./wrapper-validation
       with:
-        # to allow the invalid wrapper jar present in test data
-        allow-checksums: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-        min-wrapper-count: 11
-      # Expected to fail; validated below
+        min-wrapper-count: 7
+      # There are only 6 wrappers in workflow-samples, so expected to fail
       continue-on-error: true
 
     - name: Check outcome