[improve][ci] Configure SSH access action default and update Upterm

[lhotari]

Motivation

The SSH access action helps debug GitHub Actions issues in forks by allowing an SSH connection directly to the runner VM. SSH access is disabled for apache/pulsar by the existing workflow conditions and disabled by default for private repositories. It is enabled by default for public repositories outside apache/pulsar when the calling workflow's conditions are met.

Set CI_ENABLE_SSH=true to explicitly enable the action or CI_ENABLE_SSH=false to disable it, including in public forks. This override controls the action when invoked; it does not bypass the workflow conditions that exclude apache/pulsar. Existing authorized-user SSH key restrictions remain in place.

This change makes these defaults configurable, upgrades Linux Upterm to 0.27.0, and supports noninteractive Homebrew installation on macOS runners.

Modifications

• Default the shared SSH action to enabled for public workflow repositories and disabled for private, internal, or unknown visibility.
• Allow CI_ENABLE_SSH=true or false as a repository variable or workflow/job/step environment variable. The calling workflows pass repository variables into the action environment; job/step environment settings take precedence. Both start and wait honor the setting; invalid values fail before starting SSH.
• Upgrade the Linux download to Upterm 0.27.0 and print the installed version.
• Set HOMEBREW_NO_ASK=1 for the fully qualified Upterm cask and tmux installations. Fully qualified installation trusts the individual cask, without trusting the entire tap or disabling tap-trust checks.

Verifying this change

• Make sure that the change passes the CI checks.
• 48 default/override expression cases and 96 start/wait shell guard cases passed.
• Shell syntax validation passed; actionlint reports the same six pre-existing workflow diagnostics and no new findings.
• ./gradlew spotlessCheck checkstyleMain checkstyleTest passed across all modules.
• Homebrew 6.0.22 noninteractive cask dry run succeeded and trusted only owenthereal/upterm/upterm; a full macOS runtime session has not been tested.
• Linux CI verified that explicit false skips both start and wait without creating a session; the default public setting then starts Upterm and waits for a connection after a deliberately failed test step. The temporary verification steps and extended timeout have been removed.
• Local review found no remaining issues.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Only CI tooling and the shared action's default behavior change.