Build: fix pre-existing CI failures on 1.8.1-affirm-patch (MinIO test image, spotless)

[abrarsher23]

What this does

Fixes the CI checks that fail on every PR against 1.8.1-affirm-patch. The three commits are formatting, test images and
two style fixes; nothing changes behaviour.

Check (JDK 11 / 17 / 21)	Why it fails today	Fix in this PR
build-checks	:iceberg-core:spotlessJavaCheck flags three files that came in with #1. Once that passes, checkstyle finds two more pre-existing violations.	Run spotlessApply on them, then fix the two checkstyle issues
core-tests	6 S3 test classes in iceberg-aws can't start their MinIO container: pull access denied for minio/minio	Use Chainguard's MinIO image
kafka-connect-tests	The integration tests' docker-compose.yml pulls minio/minio and minio/mc	Use Chainguard's MinIO server and client images

Commit 1: formatting (Core: apply spotless formatting to REST retry strategy files)

./gradlew :iceberg-core:spotlessApply changes exactly the three files the check reports:
ExponentialHttpRequestRetryStrategy.java, TestExponentialHttpRequestRetryStrategy.java and TestRESTCatalog.java.
The changes are line wrapping, operator placement and two unused imports; with whitespace ignored the diff is 9 lines
added / 13 removed, and no logic changes. TestExponentialHttpRequestRetryStrategy passes locally (29/29).

Commit 2: MinIO test image (Build: use Chainguard's MinIO images in tests)

MinIO has stopped publishing minio/minio and minio/mc. Docker Hub now denies the pull, and Quay (which the 1.11 line
switched to in #11) now returns 401 for the same repository, so porting #11 would not fix this line.

• aws/src/test/.../MinioUtil.java: the container image becomes cgr.dev/chainguard/minio:latest, marked as a compatible
  substitute for minio/minio so Testcontainers' MinIOContainer still accepts it. The image's entrypoint is the minio
  binary itself, so MinIOContainer's server /data command works unchanged.
• kafka-connect/.../docker-compose.yml: minio/minio → cgr.dev/chainguard/minio:latest, minio/mc →
  cgr.dev/chainguard/minio-client:latest. The compose commands (server /data …, mc mb /data/bucket) are unchanged.

Upstream solved the same problem differently, by replacing MinIO with RustFS
(apache/iceberg#18247). That change sits on top of test refactors this
line doesn't have (the MinIO helper moved to aws/src/integration and was renamed), so cherry-picking it conflicts in
about 20 files. Swapping the image is the smallest change that works here.

Commit 3: checkstyle (Fix checkstyle violations found once spotless passes)

On the base branch the build always stopped at spotless, so checkstyle never ran. With spotless fixed it reports two
violations, both already on the base branch:

• TestExponentialHttpRequestRetryStrategy.java: @ValueSource(ints = {429}) → @ValueSource(ints = 429)
  (single-element annotation arrays must be written without braces).
• RemoveDanglingDeletesSparkAction.java: new ArrayList<>(danglingDeletes) → Lists.newArrayList(danglingDeletes)
  (the project bans new ArrayList<> in favour of Guava's Lists). It builds the same list.

How it was checked

• Formatting: :iceberg-core:spotlessJavaCheck passes; :iceberg-aws:spotlessJavaCheck and :iceberg-aws:compileTestJava pass.
• Images: both Chainguard images pull. Started locally the way the tests run it (server /data, with and without a
  named volume), the MinIO server comes up and listens on :9000.
• S3 tests on a Linux build host (with the Docker client pinned to API 1.44, which Testcontainers 1.20.4 needs on
  Docker 29): all six MinIO-backed classes pass against the Chainguard image (TestMinioUtil, TestS3FileIO,
  TestS3InputStream, TestS3OutputStream, TestFlakyS3InputStream, TestS3RestSigner: 49 tests, 0 failures), and
  the whole org.apache.iceberg.aws.s3 package passes (101 tests, 0 failures).
• Full CI build command (./gradlew -DallModules build -x test -x javadoc -x integrationTest) passes on the same host.
• TestRemoveDanglingDeleteAction (Spark 3.5) passes after the Lists.newArrayList change: 10 tests, 0 failures.
• This PR's CI: build-checks, core-tests and kafka-connect-tests pass on JDK 11, 17 and 21.

Worth knowing

• latest is the only tag Chainguard publishes for free, so these tests will pick up new MinIO releases as they come out.
  That's the same behaviour as the previous minio/minio:latest.
• Once this merges, other open PRs on this line need a rebase (or a merge of the base) to pick up the green checks.