Mark Gradle codegen tasks as @CacheableTask (#124)

Code generation output is now reproducible — #44 dropped the embedded
timestamps by default — so the `@DisableCachingByDefault` on the codegen
task no longer applies.

The validate task is less obvious: Gradle silently refuses to cache
tasks that declare no outputs ("Caching disabled ... No outputs
declared"), so swapping the annotation there alone would do nothing. It
now writes a `validation.success` marker file under the build directory,
which makes it genuinely cacheable and also lets repeated builds skip
validation as UP-TO-DATE.

Verified against a locally published plugin snapshot:

- example-client: `clean graphqlCodegenProductService --build-cache` →
FROM-CACHE, rerun → UP-TO-DATE
- scratch consumer project with `graphqlCodegenValidate`: executed →
UP-TO-DATE → FROM-CACHE after clean; a broken schema correctly
invalidates the cache and re-runs (and fails)
- `validatePlugins` passes

Closes #45

Migrate Java distribution from adopt to temurin (#98)

The `adopt` distribution is deprecated in `actions/setup-java` and emits
a deprecation warning. Migrate to the recommended `temurin` distribution
in all workflows (Build and Release).

Fix Task.getProject() deprecation at execution time (#40)

Gradle deprecated calling `Task.getProject()` at execution time, which
will become an error in Gradle 10.0. This API is incompatible with the
configuration cache, which will be the only supported mode in future
Gradle versions.

The `GraphQLCodegenGradleTask` was calling `getProject()` during task
execution to access the project directory and source set resources. The
fix injects `ProjectLayout` via the task constructor, which is the
configuration-cache-safe way to access project-related information.

Closes: #37
Closes: #1

Fix: add signing env vars to CI build step (#18)

## Why

The CI build pipeline (github.yml) runs on pushes to main. The release
workflow commits and pushes the release version (non-SNAPSHOT) before
bumping to the next SNAPSHOT. This triggers a CI build with a
non-SNAPSHOT version, which requires GPG signing.

Without the signing secrets, this CI build fails with "no configured
signatory" error.

## Changes

- Added signing environment variables to the "Build library" step in
`github.yml`:
  - `ORG_GRADLE_PROJECT_signingInMemoryKey`
  - `ORG_GRADLE_PROJECT_signingInMemoryKeyPassword`

Fix: add signing env vars to library build step (#17)

## Why

The library build step runs `./gradlew build publishToMavenLocal` after
the version has been changed from SNAPSHOT to a release version (e.g.,
`6.0.0-rc1`). This triggers GPG signing because `signAllPublications()`
is configured in `build.gradle` and the version no longer ends with
`-SNAPSHOT`.

Without the signing environment variables, the build fails with:
```
> Task :signMavenPublication FAILED
> Cannot perform signing task ':signMavenPublication' because it has no configured signatory
```

## Changes

- Added signing environment variables to the "Build library" step:
  - `ORG_GRADLE_PROJECT_signingInMemoryKey`
  - `ORG_GRADLE_PROJECT_signingInMemoryKeyPassword`

## Testing

Verified that:
- ✅ Library build with SNAPSHOT version → signing skipped (works without
env vars)
- ❌ Library build with release version → signing required (fails without
env vars)
- ✅ Library build with release version + signing env vars → works
- ✅ Gradle plugin build → no signing configured (works without env vars)
- ✅ Example builds → no signing configured (works without env vars)

Note: Removed `ORG_GRADLE_PROJECT_signingInMemoryKeyId` because the
plugin requires it in short 8-character format, and it's optional
(auto-detected from the key).