I think option/bullet 2 keeps things as streamlined as possible - base standard image for java apps that apps then use as their base when they build their container images to run in k8s containers. Maybe there's a way to tag base images with major.minor so that apps just pull that image and if its cached its faster and if there was a major.minor.patch just applied and you're the first app to deploy then that app pays the penalty of waiting for the underlying base image to be rebuilt.
A volume is an interesting idea but are there possible issues for OS library dependencies like openssl, database drivers, etc. that might not be the right version for a JDK mounted on a shared volume?