Build: Bump caffeine from 2.9.3 to 3.2.0

[moomindani]

Caffeine 2.9.3 dates to December 3, 2021; this bumps it to 3.2.0 (January 2025) — ~4.5 years and a major line newer. Dependabot ignores major updates for the gradle ecosystem (version-update:semver-major), so the catalog has stayed on 2.9.3.

No production source changes are required: the API Iceberg uses (Caffeine.newBuilder, expireAfterAccess/expireAfterWrite, maximumSize, softValues/weakValues, removalListener, Ticker, LoadingCache) is unchanged between 2.x and 3.x, and Iceberg already targets Java 17 (Caffeine 3.x requires Java 11+).

Bundled dependency changes. Caffeine 3.x migrated its nullness annotations from the Checker Framework to JSpecify, so the runtime bundles now pull org.jspecify:jspecify:1.0 in place of org.checkerframework:checker-qual, along with a newer com.google.errorprone:error_prone_annotations. I regenerated the affected runtime-deps.txt baselines via ./gradlew :<module>:generateRuntimeDeps (spark 3.5/4.0/4.1, flink 1.20/2.0/2.1, kafka-connect) and updated the spark/flink runtime LICENSE files to swap the checker-qual entry for JSpecify (Apache-2.0). aws-bundle is intentionally unchanged — it pulls Caffeine 2.9 transitively from the AWS SDK, independent of this catalog version. checkRuntimeDeps passes for the spark and flink runtimes.

Test change. TestCacheMetricsReport#testCacheMetricsFromCaffeineCache asserted an exact eviction count of 2. Under Caffeine 3.x that scenario's weighted-eviction count is implementation-dependent (the admission policy may evict the incoming entry or existing ones, yielding 1 or 2 across runs), so the assertion now checks evictionCount() is non-zero instead of an exact value. Only the test assertion changed; CacheMetricsReport itself is unchanged.

Why it's worth doing, tied to how Iceberg uses Caffeine:

• Forward-compatibility: 3.x drops the sun.misc.Unsafe dependency in favor of VarHandle (since 3.0). Unsafe memory access is deprecated for removal and warns on recent JDKs, so this matters for Iceberg/Spark running on newer Java.
• expireAfterWrite path: 3.2 extended the expiration-write optimization to more operations. Iceberg already uses expireAfterWrite (StandardEncryptionManager, RESTTableCache, the S3 REST signer cache), and implement cache policy #14440 is proposing to add it to the catalog cache as well.

Verified iceberg-core, iceberg-aws, iceberg-hive-metastore, iceberg-spark-4.1, and iceberg-flink-1.20 compile, and core cache tests pass.