This pull request updates the Java setup action to change how signature verification is handled for downloaded Java packages. Signature verification is now enabled by default for the temurin and microsoft distributions, while remaining disabled for others unless explicitly set. The changes also update documentation, input handling, and tests to reflect this new default behavior.

Key changes include:

Default Behavior and Input Handling:

• Signature verification (verify-signature) now defaults to enabled for temurin and microsoft distributions, and is disabled for others unless explicitly specified. The input is now optional, and if not provided, the action determines the default based on the distribution. [1] [2] [3]
• The action.yml and README.md have been updated to reflect the new default behavior for verify-signature. [1] [2]
• The input parsing logic in src/setup-java.ts now uses a new function getVerifySignatureInput() to correctly handle undefined or explicit values for verify-signature. [1] [2] [3]

Testing and Validation:

• Tests for both temurin and microsoft installers have been updated to verify that signature verification is enabled by default, and to check that it can be explicitly disabled when requested. [1] [2] [3] [4]
• Orchestration tests in setup-java.test.ts have been updated to check that the correct signature verification value is passed to the distribution based on input and defaults. [1] [2] [3]

These changes ensure better security defaults for supported distributions while allowing users to override signature verification behavior as needed.