Add JDK 17 fallback to mvn-spotless-apply.sh

[Divyansh-db]

Summary

Adds a JDK 17 fallback to scripts/mvn-spotless-apply.sh so mvn spotless:apply
still formats successfully when the default JDK is older than 17, bringing the
script to parity with the existing make fmt → make fmt-jdk17 behaviour.

Why

scripts/mvn-spotless-apply.sh is the wrapper used to run spotless:apply (it is
invoked by codegen post-generation via .codegen.json, and by contributors who
format locally). It exported the --add-exports flags google-java-format needs on
JDK 16+, then exec'd mvn spotless:apply directly — with no recovery path.

The pinned google-java-format 1.27.0 requires JRE 17+. So on a machine whose
default JDK is older than 17 (e.g. JDK 11) the command fails outright with a
PluginContainerException, even when a JDK 17 is installed on the box.

make fmt already guards against this — it retries under JDK 17 (make fmt-jdk17)
when the first spotless:apply fails. The script had no such safety net. This PR
adds the equivalent fallback so both entry points behave the same.

What changed

Interface changes

None to any public API — this is an internal build script. It is still invoked the
same way (bash scripts/mvn-spotless-apply.sh); the only addition is an optional
JDK17_HOME environment override.

Behavioral changes

• If the first spotless:apply attempt fails, the script now prints a clear message
  and retries once under an explicit JDK 17 install instead of exiting.
• Version detection now reads the JVM Maven will actually use — $JAVA_HOME/bin/java
  when JAVA_HOME is set, otherwise java on PATH. This makes the --add-exports
  gating match the running JDK, and means re-running with JAVA_HOME pointed at a
  JDK 17+ succeeds on the first attempt (no fallback needed).
• The fallback JDK 17 location is overridable via JDK17_HOME (defaulting to the
  same Debian/amd64 path make fmt uses), and the script errors clearly — pointing
  at JDK17_HOME / JAVA_HOME — when no JDK 17 is found.

Internal changes

• Added a NEXT_CHANGELOG.md entry under Internal Changes.

How is this tested?

Verified manually on a machine whose default JDK is 11 with JDK 17 installed:

• Default run (bash scripts/mvn-spotless-apply.sh): the first attempt under
  JDK 11 fails as expected (BUILD FAILURE), the fallback message is printed, and the
  JDK 17 retry runs spotless:apply to BUILD SUCCESS (exit 0).
• JAVA_HOME=<jdk17> bash scripts/mvn-spotless-apply.sh: succeeds on the first
  attempt with no fallback, confirming the version detection honours JAVA_HOME.
• bash -n syntax check passes.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-java

Inputs:

• PR number: 841
• Commit SHA: 34a116d2f840707b8f2984c6a649a9d1144895f3

Checks will be approved automatically on success.