ci: enable native in downstream to enterprise

[rsynek]

Enables native in the enterprise PR check in the same scope we have it in the enterprise repo.

Obviously, this will cost us some CI time on the PR, so a discussion is welcome.

[Copilot]

Pull request overview

This PR extends the secured downstream enterprise PR checks by adding a new matrix job that builds and verifies the Enterprise Edition in GraalVM native-image mode (Linux x64 + ARM) for both Spring Boot and Quarkus modules.

Changes:

• Add a new enterprise-native job to pull_request_secure.yml to run native-image verification against timefold-solver-enterprise.
• Set up GraalVM (with Maven cache) and run -Dnative verify in the relevant enterprise modules as part of the secured workflow.

Comments suppressed due to low confidence (2)

.github/workflows/pull_request_secure.yml:164

• Using an unpinned actions/checkout tag in a secrets-bearing workflow increases supply-chain risk if the tag ever moves.

      - name: Checkout timefold-solver-enterprise (PR) # Checkout the PR branch first, if it exists
        id: checkout-solver-enterprise
        uses: actions/checkout@v7
        continue-on-error: true

.github/workflows/pull_request_secure.yml:174

• Using an unpinned actions/checkout tag in a secrets-bearing workflow increases supply-chain risk if the tag ever moves.

      - name: Checkout timefold-solver-enterprise (main) # Checkout the main branch if the PR branch does not exist
        if: steps.checkout-solver-enterprise.outcome != 'success'
        uses: actions/checkout@v7
        with:

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud