Liberica: java-version 25 resolves to 25.0.5+11 instead of the latest 25.0.5.0.3+5 #1306

Description:
With distribution: 'liberica' and java-version: 25, setup-java installs 25.0.5+11 instead of the latest Liberica build for 25, which is 25.0.5.0.3+5. BellSoft released 25.0.5.0.2+5 and 25.0.5.0.3+5 after the October CPU. Per the BellSoft maintainers in bell-sw/Liberica#243, .0.3 is the build that fixes CVE-2026-114820, which removes compromised roots from cacerts. Because setup-java resolves to 25.0.5+11, workflows asking for "latest 25" silently get a JDK without that fix.

Task version:
actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0.

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:

1. Use this step:

   -  uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
      with:
        java-version: 25
        distribution: 'liberica'
        java-package: 'jdk+fx'
   

Public example: https://github.com/torakiki/pdfsam/blob/master/.github/workflows/release.yml

Expected behavior:
java-version: 25 resolves to the latest Liberica 25 build, 25.0.5.0.3+5.

Actual behavior:
setup-java resolves to 25.0.5+11, the October GA build, which does not include the fix for CVE-2026-114820.