chore(deps): upgrade java to 25, scylla-driver to 3.11.5.14 and add Renovate

[CodeLieutenant]

Summary

This PR bundles three related upgrades:

Java 25

• Bump build target from Java 21 → Java 25 across all configs: pom.xml, all GitHub Actions workflows, Dockerfile (now eclipse-temurin:25-jdk/jre-noble), and scripts/package.sh
• Bump JaCoCo in dynamodb/pom.xml from 0.8.11 → 0.8.13 — required because 0.8.11 does not support Java 25 class files (major version 69) and would crash at instrumentation time
• Pin all CI runners from ubuntu-latest → ubuntu-24.04 for reproducible builds

ScyllaDB driver upgrade

• Bump com.scylladb:scylla-driver-core from 3.10.2-scylla-1 (≈2 years old) to 3.11.5.14. The new release adds detailed OperationTimedOutException diagnostics — pool contention vs server-side slowness, in-flight and pending borrow counts — directly useful for triaging Error inserting key failures under heavy YCSB load. Also rolls in LWT replica-only routing + DefaultResultSetFuture completion fixes from the 3.11.5.x line.
• Bump the netty override (netty-handler / netty-transport / netty-codec) from 4.1.112.Final → **4.1.132.Final`` and promote to a netty.versionproperty inscylla/pom.xml` for a single source of truth.

Renovate

• Add renovate.json at repo root so the Renovate GitHub App can keep Maven, Dockerfile, and GitHub Actions deps fresh going forward — with sensible groupings (ScyllaDB drivers, AWS SDK v2, Netty, Testcontainers, Jackson, SLF4J, Maven plugins, GH Actions, Docker base images) and major-bump guardrails.
• eclipse-temurin and com.scylladb:java-driver-core major bumps are disabled — Java 25 is now the pinned build target, and the 4.x driver line would require a full API rewrite.

Why Java 25

Java 25 is the next LTS release (GA September 2025). Adopting it now:

• Enables use of finalized features from recent preview cycles (virtual threads, structured concurrency, value types groundwork)
• Keeps the project ahead of the curve for Temurin LTS support windows
• Required bumping JaCoCo and pinning the runner OS as part of the cleanup

Verification

• mvn -pl scylla -am clean package -DskipTests → BUILD SUCCESS on Java 25
• mvn -pl dynamodb -am test → passes with JaCoCo 0.8.13
• mvn -pl scylla dependency:tree confirms scylla-driver-core:3.11.5.14 and io.netty:*:4.1.132.Final resolve cleanly

Test plan

• Confirm full test suite passes on Java 25 in CI
• Run load workload (bin/ycsb.sh load scylla -P workloads/workloada -threads 100 -p recordcount=18000000 …) and verify new timeout diagnostics surface in OperationTimedOutException
• After merge, enable Renovate on the repo and sanity-check the first batch of dependency-dashboard PRs

Notes for reviewer

• org.testcontainers:testcontainers:2.0.3 in dynamodb/pom.xml looks like a pre-existing typo — latest is 1.21.x. Worth a follow-up PR.
• Netty exclusions on scylla-driver-core are intentionally kept so the resolved netty version stays under our control.

[fruch]

We need to test it all around change of java version is always breaking things

Before we have a clear longevity run in SCT we shouldn't merge

[CodeLieutenant]

We need to test it all around change of java version is always breaking things

Before we have a clear longevity run in SCT we shouldn't merge

Yes of course, this is just the placeholder for it. And the priority is #34