Disable explicit cache usage to reduce the cache poisoning vector attack

[fr4nc1sc0-r4m0n]

Summary

After a deep analysis, remove explicit cache usage in release related workflow to reduce the cache poisoning vector attack.

Why

In the context of setting up Java, the actions/setup-java is explicitly using the gradle cache format.
If a workflow running untrusted code has access to the cache, it can poison the cache with malicious content. For example, a compromised dependency could inject malicious code into a Golang binary or Docker image, which would then be included in subsequent builds using the same cache key.

This attack is particularly dangerous because the malicious artefact can be signed and distributed as part of an SLSA Level 3 build, leaving no trace in the source code or build logs.