Prepare CI for Pulsar 5.x support with separate broker and connector images

[lhotari]

Motivation

Prepare CI for Pulsar 5.x support by removing the integration tests' dependency on pulsar-all as the broker image. Pulsar 5.x will use a separate distribution of Pulsar IO connectors, so sink/source tests need to obtain connector files independently of the broker image and version.

This change adds that configuration and image assembly support while retaining apachepulsar/pulsar:latest for the broker and apachepulsar/pulsar-all:latest as the current connector source. CI can switch to the future connector image, including a scratch image with an independent release tag, through repository variables when it becomes available.

Modifications

• Default the broker to apachepulsar/pulsar:latest and the connector source to apachepulsar/pulsar-all:latest.
• Add PULSAR_IO_IMAGE and PULSAR_IO_IMAGE_VERSION; the connector tag defaults to PULSAR_VERSION but can follow an independent release cycle.
• Use a separate Dockerfile target for sink/source tests that copies files from the connector image into the broker test image. The source image is never executed and can be a scratch image. PULSAR_IO_CONNECTORS_DIR configures the source path, defaulting to /pulsar/connectors.
• Expose the image, connector tag, and connector directory settings through GitHub Actions repository variables. Preserve staging defaults for StreamNative bot runs.

Verifying this change

• After rebasing onto 48d6ff9 (the policies environment fix in Fix policies tests with Pulsar 5 bundles #2155), the policies suite passed against docker-proxy.streamnative.io/snstage/pulsar-cloud:5.0.0-M1-SNAPSHOT without any script-level namespace-bundle override.
• Shell syntax and command checks passed for all seven modes, including connector target selection and use of the upstream policies environment file.
• Image composition validation from before the rebase: general, token, TLS, function, and package suites passed against apachepulsar/pulsar:latest; sink tests passed with connectors copied from apachepulsar/pulsar-all:latest; source tests passed with connectors copied from a scratch image using an independent fixture-v1 tag and / source directory.
• The regular Dockerfile target built successfully with an intentionally invalid connector image, confirming that non-IO tests do not fetch it. All 35 image/tag configuration combinations passed.
• Actionlint reported only the existing path-ignores and actions/checkout@v2 diagnostics; no new findings.

Documentation

• doc — Documented image settings, tag defaults, and a scratch-image example in CONTRIBUTING.md.