CombinePerKey with gbek (Java)

[damccorm]

As written right now, enabling the GBEK pipeline option doesn't work with CombinePerKey on runners which replace CombinePerKey. This is because CombinePerKey contains a GroupByKey; when runners replace this transform, they will either (a) notice that the transform structure doesn't match what they expect and fail (this is what the Dataflow runner does) or (b) silently replace the new GroupByEncryptedKey with whatever their default implementation is.

In fact, a naive optimized version of GroupByEncryptedKey cannot work at all since encryption happens before handing control to the runner, meaning that combiner lifting can't happen by default. For now, we'll work around this by not doing any lifting of CombinePerKey and using the default implementation, though this could be optimized in the future.

Before my code changes, the test I added fails - https://github.com/apache/beam/actions/runs/18283892988/job/52053601698?pr=36408. Here's an example job showing the failure - https://console.cloud.google.com/dataflow/jobs/us-central1/2025-10-06_13_10_01-16359004956332121727

After my code changes, this succeeds

Part of #36214

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.19%. Comparing base (312509f) to head (55b9432).
⚠️ Report is 11 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #36408      +/-   ##
============================================
+ Coverage     36.22%   40.19%   +3.97%     
- Complexity     1666     3385    +1719     
============================================
  Files          1058     1220     +162     
  Lines        165088   186182   +21094     
  Branches       1190     3524    +2334     
============================================
+ Hits          59796    74836   +15040     
- Misses       103116   107984    +4868     
- Partials       2176     3362    +1186     

Flag	Coverage Δ
java	70.39% <ø> (+2.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[damccorm]

R: @shunping

(since this is the Java version of #36382)

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers

[shunping]

LGTM. Do you want to try importing internally and see if there would be any broken internal tests?

[damccorm]

It doesn't seem to want to cherry-pick in because of my kind of funky commit history, so I'm going to merge and deal with any issues on that end. These tests shouldn't be exercised internally, so I think it will be ok