CI: exclude automated/bot PRs from secret-bearing Sonar/Codecov steps #206

Problem

The Java CI with Maven workflow currently gates its secret-bearing steps (SonarCloud Analysis, Upload test results to Codecov, Upload coverage to Codecov) on secret availability:

if: env.SONAR_TOKEN != ''      # Sonar
if: always() && env.CODECOV_TOKEN != ''   # Codecov

This relies on GitHub withholding secrets from automated PRs, which is not robust:

• When a maintainer re-runs a Dependabot PR's failed jobs, the run executes in the maintainer's context and secrets are available. Observed live on the github-actions Dependabot PR (Bump the github-actions group across 1 directory with 10 updates #205): the SonarCloud Analysis step executed and failed (HTTP 403 ... check SONAR_TOKEN) instead of being skipped.
• The older approach of matching github.actor != 'dependabot[bot]' is brittle: it only catches one exact bot name and misses other automated authors (Renovate, custom bots).

Sonar/Codecov analysis for these PRs should only ever run through the intended paths (normal push/human PRs on the base repo, or the manually-approved fork workflows) — never automatically for bot-authored PRs.

Proposed fix

Add a generic, non-name-based bot exclusion to the secret-bearing steps, using the PR author's account type rather than a hard-coded login:

# runs on push (no PR context) and on human PRs; skipped for ANY bot-authored PR
if: env.SONAR_TOKEN != '' && github.event.pull_request.user.type != 'Bot'

• On push to main, github.event.pull_request is empty so user.type is '' ≠ 'Bot' → Sonar/Codecov still run.
• On a human same-repo PR, user.type == 'User' → run.
• On any bot-authored PR (Dependabot, Renovate, …), user.type == 'Bot' → skipped, even when re-run by a maintainer.
• Fork PRs remain covered by the existing secret-withholding + the manual fork-coverage/fork-sonar workflows.

This keeps the change minimal (condition-only), follows the existing security posture, and does not alter build/test behaviour.