[release-2.77] Cherry-pick RestrictionTrackers lock timeout fixes (#40205, #40251) - #40287

On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

Failed to save: Unable to reserve cache with key setup-python-Linux-x64-24.04-Ubuntu-python-3.10.21-pip-f19a9eff1390264083c47b799300cfb05305bb36963f07202f2a4544f55f46a1. More details: cache write denied: token has no writable scopes

Failed to restore gradle-build-cache-v2-12582fc6541155965faba29fe27a3cc0: AbortError: The operation was aborted.