chore: nixify Jena in validation workflow

[paolino]

Summary

The validation workflow currently downloads Apache Jena from the archive at runtime inside validate-action/action.yml. That makes CI slower, adds a network dependency, and bypasses the Nix-based toolchain the repo already uses locally.

We should make Jena available through a nixified path in CI and stop fetching the tarball on every run.

Acceptance criteria

• validate-action no longer downloads Apache Jena from archive.apache.org at runtime
• The SHACL validation step still works in CI
• The toolchain used for SHACL validation is provided through a reproducible Nix-based path or equivalent prebuilt action/runtime choice committed in the repo
• CI runtime for graph validation is reduced or at least no longer dominated by the Jena bootstrap step
• The repo docs or action docs mention the chosen Jena/SHACL runtime approach if the setup changes materially

Context

Current mismatch:

• flake.nix already includes pkgs.apache-jena for local/dev usage
• validate-action/action.yml still bootstraps Jena by downloading and unpacking a tarball during the workflow

Relevant files:

• flake.nix
• validate-action/action.yml
• justfile

This should be addressed before more RDF/ontology workflow grows around the same validation path.