Report concrete versions for floating Oracle JDK downloads (#1213)

* Fix floating Oracle JDK version resolution

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update generated distribution bundles

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Harden floating artifact cache identity

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Regenerate setup bundle after cache hardening

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Temporarily enable hosted full validation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Export hosted formatting results

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Apply repository formatting

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Run hosted validation after formatting

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Correct floating version regression tests

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove temporary validation wiring

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Cache checksum-less floating artifacts by their response fingerprint

Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next
to a `/latest/` artifact. Those floating releases were excluded from both
the resolution cache and the JDK cache, so `cache-jdk` users lost caching
entirely for them.

A floating URL is a constant string, so it cannot serve as a cache
identity on its own — a stale entry would be reused forever. Instead,
derive a validator from the headers of the HEAD request that already
resolves the artifact: the ETag when present, otherwise `Last-Modified`
combined with `Content-Length`. Republishing changes the validator, which
changes the cache key, so a new build is downloaded rather than masked.

`getJdkReleaseIdentity` now falls back to that fingerprint before the
URL, and the floating cache gates ask whether the release has a stable
identity (checksum or fingerprint) rather than a checksum specifically. A
floating release with neither is still left uncached.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>

dist/setup/348.index.js

@@ -149,7 +149,8 @@ function getResolutionIdentity(request) {
         packageType: request.packageType.toLowerCase(),
         architecture: request.architecture.toLowerCase(),
         versionSpec: request.versionSpec,
-        stable: request.stable
+        stable: request.stable,
+        source: request.source
     });
     return (0,crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(identity).digest('hex');
 }
@@ -191,6 +192,7 @@ function parseResolvedRelease(contents) {
     const version = candidate['version'];
     const url = candidate['url'];
     const signatureUrl = candidate['signatureUrl'];
+    const floating = candidate['floating'];
     if (typeof version !== 'string' || !version) {
         throw new Error('The cached resolution has no version.');
     }
@@ -198,6 +200,9 @@ function parseResolvedRelease(contents) {
     if (signatureUrl !== undefined) {
         assertHttpsUrl(signatureUrl, 'signatureUrl');
     }
+    if (floating !== undefined && typeof floating !== 'boolean') {
+        throw new Error('The cached resolution has an invalid floating flag.');
+    }
     const release = {
         version,
         url: url
@@ -205,6 +210,9 @@ function parseResolvedRelease(contents) {
     if (signatureUrl !== undefined) {
         release.signatureUrl = signatureUrl;
     }
+    if (floating !== undefined) {
+        release.floating = floating;
+    }
     const checksum = candidate['checksum'];
     if (checksum !== undefined) {
         release.checksum = parseChecksum(checksum);