Rework/simplify GH Actions jobs

[yrodiere]

• Use pull_request instead of pull_request_target
• Move Develocity build scan publishing for untrusted code to a separate workflow
• Merge Atlas workflow into the main CI workflow
• Split caches between trusted and untrusted code
• Update secrets to use "Develocity" name instead of "Gradle Enterprise"
• Update comments

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license
and can be relicensed under the terms of the LGPL v2.1 license in the future at the maintainers' discretion.
For more information on licensing, please check here.

---

[hibernate-github-bot]

Thanks for your pull request!

This pull request does not follow the contribution rules. Could you have a look?

❌ All commit messages should start with a JIRA issue key matching pattern HHH-\d+
    ↳ Offending commits: [c00d8eb]

› This message was automatically generated.

[yrodiere]

Note the oracle_atps failure is unrelated, as it's been failing for a few days already: https://github.com/hibernate/hibernate-orm/actions/runs/11489734604/job/31980895415

[yrodiere]

There's something very wrong with the build scan data on some Oracle builds:

I'll look into it...

[yrodiere]

There's something very wrong with the build scan data on some Oracle builds:

It's the GitHub cache... .gradle/build-scan-data is being restored from the cache, and spool contains about a hundred older build scans.

I'll add a commit so that we never include build-scan-data in the GitHub cache, but we'll need to wipe our GitHub cache to solve this before the next cache generation.

EDIT: Wrong, see below.

[yrodiere]

Actually that's wrong, since we change the name of the cache in this very PR.

So, I think the GitHub runner just has some leftover build scans that don't get cleaned up between builds.

Which makes you extra right to not trust these runners with secrets, @beikov , as the older build scans could be coming from anywhere.

I'll add something to clean up the .gradle directory before the build starts.

EDIT: Done

[yrodiere]

Merging, since Christian had a look yesterday already.