UID2-7041: add Set up Docker Buildx to Java publish workflow

[BehnamMozafari]

Summary

Follow-up to PR #231 (UID2-7041). Two regressions that #231 introduced into the Java reusable workflow shared-publish-java-to-docker-versioned.yaml:

1. Missing docker/setup-buildx-action — push-by-digest=true is only implemented in the docker-container driver, not the default docker driver. Caused: ERROR: failed to build: push-by-digest is currently not implemented for docker driver, please create a new builder instance — https://github.com/IABTechLab/uid2-admin/actions/runs/25890841551/job/76093405178
2. Image reference not lowercased — old tags: field was lowercased by docker/metadata-action; the new outputs: type=image,name=<expr> is not, so ${{ github.repository }} (case-preserving) failed: invalid reference format: repository name (IABTechLab/uid2-admin) must be lowercase.

Same root cause for both: Task 2 inlined the push step in the Java workflow without re-creating the supporting setup that docker/metadata-action and the composite's Set up Docker Buildx step were providing.

Fix

• Java workflow (shared-publish-java-to-docker-versioned.yaml): add docker/setup-buildx-action@8d2750c6... step, plus a Lowercase image reference step whose output is reused in both push outputs: and promote SOURCE:.
• Composite (actions/shared_publish_to_docker/action.yaml): add the same Lowercase image reference step for defensive symmetry — current generic-flow callers happen to pass lowercase docker_image_name, but the case wasn't enforced. (Buildx setup was already present in the composite.)

Smoke evidence

Pinned consumer test branches to this PR's tip SHA, dispatched Snapshot releases (snapshot path = real push-by-digest + promote, with attest correctly skipped):

Flow	Consumer	Run	Notes
Java workflow (Task 2 path)	uid2-admin	25891649352	Set up Buildx ✓ · Lowercase image ✓ · Push-by-digest ✓ · Promote ✓
Generic flow via composite (Task 1 path)	uid2-tcportal	25891659704	Both publishToUID2 + publishToEUID green (4m21s / 4m4s)

Scope of breakage from #231

• Composite path (shared-publish-to-docker-versioned.yaml): only the lowercase fix is defensively useful; buildx was already set up and current generic-flow callers pass lowercase docker_image_name, so no live breakage.
• Java path (shared-publish-java-to-docker-versioned.yaml): both fixes needed. Every Java publish after UID2-7041: promote OCI tag only after attest+verify pass #231 merged was broken; ship this and re-cut @v3 ASAP.

Test plan

• uid2-admin (Java) Snapshot via test branch pinned to this PR
• uid2-tcportal (generic) Snapshot via test branch pinned to this PR
• After merge: update-major-version-tags moves @v3 to this SHA
• Confirm the originally-failing uid2-admin workflow now succeeds on @v3

🤖 Generated with Claude Code