ci: cache Gradle, harden permissions, fix test triggers (#45)

- Add gradle/actions/setup-gradle caching to all three workflows
- test.yml: trigger on pull_request + push to master (was branches-ignore: master), so PRs from forks are covered and master is verified after merge; add least-privilege permissions and PR-only concurrency
- publishRelease.yml: drop unused 'secrets: inherit' and the dead SNAPSHOT env var (Gradle reads the snapshot project property, not a plain env var); add contents: read permissions; fix the misleading Maven Central comment (upload only stages on Central Portal, the final Publish is manual)
- docs.yml: add Gradle caching

.github/workflows/docs.yml

@@ -26,6 +26,8 @@ jobs:
         with:
           distribution: temurin
           java-version: '21'
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
       - name: Generate API docs
         run: ./gradlew :dokkaGeneratePublicationHtml --console=plain
       - name: Upload Pages artifact