New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline