Separate java upgrade ci job for bridged providers

[VenelinMartinov]

Bridged providers should not upgrade their java version with provider upgrades but instead have a separate job dedicated to that.

[t0yv0]

That's really needed now.

[t0yv0]

Context: #1611

The latest workflows on main ship an https://github.com/pulumi/pulumi-tls/blob/main/.github/workflows/upgrade-java.yml job for bridged providers that can do the update via upgrade-provider.

Example PR: pulumi/pulumi-tls#812

There is an update-java job that just calls these workflows in a fan-out:
https://github.com/pulumi/ci-mgmt/actions/workflows/update-java.yml

My next steps are trying to run that one so that it does not fail.

[t0yv0]

Example of the workflow working end to end:

Calling https://github.com/pulumi/ci-mgmt/actions/runs/16328313981 with provider=random version=1.16.0

Dispatches this job: https://github.com/pulumi/pulumi-random/actions/runs/16328321164/job/46124153106

Creates this PR: pulumi/pulumi-random#1835

[t0yv0]

There is a problem with PRs generated by this job.

pulumi/pulumi-auth0#904 is opened by github-actions bot

In contrast:

pulumi/pulumi-auth0#889 is opened by pulumi-bot

which is probably what we would want, because github-actions opened PRs need closing and reopening to kick off tests runs.

I wonder what is different in the environment