Optimize Temurin tool-cache fast path with lazy loading (#1179)

* Optimize Temurin tool-cache fast path

- Lazy-load distribution installers so only the selected distro module is initialized
- Defer cache feature/cache module loading until cache input is provided
- Start cache restore early and await it safely alongside Java setup flow
- Update orchestration and lazy-loading tests; regenerate dist artifacts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad

* Address PR review comments

- Lazy-load cache save in cleanup path so no-cache runs avoid cache module init in post action
- Stage dist/setup/package.json in release script for chunked setup bundle completeness

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad

* Fix CodeQL comment tag filter finding

Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e

* Rebuild generated dist bundles

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad
Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e

scripts/patch-is-unsafe.mjs

@@ -0,0 +1,20 @@
+import {readFile, writeFile} from 'node:fs/promises';
+
+const sourcePath = new URL('../node_modules/is-unsafe/src/contexts/xml.js', import.meta.url);
+const vulnerablePattern = 'pattern: /-->/,';
+const safePattern = 'pattern: /--!?>/,';
+const source = await readFile(sourcePath, 'utf8');
+
+// CodeQL treats this XML detector as an incomplete HTML comment-end filter.
+if (source.includes(safePattern)) {
+  process.exit(0);
+}
+
+const occurrences = source.split(vulnerablePattern).length - 1;
+if (occurrences !== 1) {
+  throw new Error(
+    `Expected one ${JSON.stringify(vulnerablePattern)} in ${sourcePath.pathname}, found ${occurrences}`
+  );
+}
+
+await writeFile(sourcePath, source.replace(vulnerablePattern, safePattern));