pending actions will be stored in /var/lib/ca-certificates-java

the hook script is executed in the context of ca-certificates
and nothing is known at that time about the configuration state
of ca-certificates-java or its rdepends

so just record the pending updates and execute them in a context
where ca-certificates-java and its rdepends are in a usable state

Closes: #925431

a specific OpenJDK package.

Closes: #864657