ci: Bump gradle/actions from 5 to 6 in the actions-major group

[dependabot]

Bumps the actions-major group with 1 update: gradle/actions.

Updates gradle/actions from 5 to 6

Release notes

Sourced from gradle/actions's releases.

v6.0.0

[!IMPORTANT] The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post. TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

• Caching functionality of 'gradle-actions' has been extracted into a separate gradle-actions-caching library, and is no longer open-source. See this blog post for more context.
• Existing, rudimentary, configuration-cache support has been removed, pending a fully functional implementation in gradle-actions-caching.
• Dependencies updated to address security vulnerabilities

[!IMPORTANT]

Licensing notice

The caching functionality in `gradle-actions` has been extracted into `gradle-actions-caching`, a proprietary commercial component that is not covered by the MIT License. The bundled `gradle-actions-caching` component is licensed and governed by a separate license, available at https://gradle.com/legal/terms-of-use/.

The `gradle-actions-caching` component is used only when caching is enabled and is not loaded or used when caching is disabled.

Use of the `gradle-actions-caching` component is subject to a separate license, available at https://gradle.com/legal/terms-of-use/. If you do not agree to these license terms, do not use the `gradle-actions-caching` component.

What's Changed

• Bump the npm-dependencies group in /sources with 2 updates by @​dependabot[bot] in gradle/actions#866
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#868
• Dependency updates by @​bigdaz in gradle/actions#876
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#878
• Bump @​types/node from 25.3.3 to 25.3.5 in /sources in the npm-dependencies group across 1 directory by @​dependabot[bot] in gradle/actions#877
• Bump the github-actions group across 3 directories with 3 updates by @​dependabot[bot] in gradle/actions#867
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#881
• Bump the npm-dependencies group in /sources with 6 updates by @​dependabot[bot] in gradle/actions#879
• Bump the github-actions group across 3 directories with 5 updates by @​dependabot[bot] in gradle/actions#880
• Remove configuration-cache support by @​bigdaz in gradle/actions#884
• Extract caching logic into a separate gradle-actions-caching component by @​bigdaz in gradle/actions#885
• Update gradle-actions-caching library to v0.3.0 by @​bot-githubaction in gradle/actions#899
• Avoid windows shutdown bug by @​bigdaz in gradle/actions#900
• Dependency updates by @​bigdaz in gradle/actions#905
• Fix critical and high npm vulnerabilities by @​bigdaz in gradle/actions#904
• Fix rendering of job-disabled message by @​bigdaz in gradle/actions#909

Full Changelog: gradle/actions@v5.0.2...v6.0.0

v5.0.2

Summary

This release contains no functional changes. It updates dependencies and known Gradle wrapper checksums.

What's Changed

• Update dependencies by @​bigdaz in gradle/actions#851

... (truncated)

Commits

• 3f5f9ad Document the new Gradle signing key for dependency verification (#1071)
• b031f6d [bot] Update dist directory
• 5bc4175 Bump dependency-graph-gradle-plugin to 1.5.0 (#1069)
• f3ff59b Combined automated updates: wrapper checksums, npm dependencies, setup-java (...
• 7927085 Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (#1068)
• c3897a4 [bot] Update dist directory
• 6b92be1 Update dependencies (#1065)
• 0d208da [bot] Update dist directory
• e49d0a3 Report EOL and maintenance status for Gradle versions (#1057)
• 575435b Use the root-qualified :wrapper task (#1064)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jvsena42]

Pushed one commit on top of the bump: every setup-gradle step now sets cache-provider: basic, the MIT provider added in v6.1.0, so this does not opt into the proprietary gradle-actions-caching default that the v5 pin was avoiding. The pin comment in ci.yml is rewritten to say so.

The pin's other reason (lost configuration-cache support) did not apply here: v5 only saved that data when cache-encryption-key was set, and no workflow passes one.

The three release.yml steps are not exercised by this PR's run.