USPR-13774: bump io.netty vulnerability floor to 4.2.16.Final

[midnight-clue]

Context & Problem

A GitHub Dependabot alert (#107, HIGH severity) flagged io.netty:netty-codec-http versions 4.2.0.Final-4.2.15.Final as vulnerable to a ByteBuf reference leak on RST_STREAM handling, causing native memory exhaustion (GHSA-jppx-w49h-x2qq). The repo's build.gradle resolutionStrategy override for io.netty pinned the floor at exactly 4.2.15.Final, which is itself the last vulnerable version for this advisory. See USPR-13774.

Solution

Bumped the io.netty resolutionStrategy.eachDependency floor in the root build.gradle from 4.2.15.Final to 4.2.16.Final (the patched version), appending the new GHSA-jppx-w49h-x2qq reference to the existing because(...) message while keeping all prior GHSA references intact. Also updated the matching ext['netty.version'] Spring Boot dependency-management overrides in the two example modules (example-spring-boot-starter-web and example-spring-boot-starter-webflux) to keep them consistent with the new floor, following the same lockstep pattern used when this mechanism was introduced (commit 850a009).

Verification

• io.netty resolutionStrategy floor raised to 4.2.16.Final in build.gradle (confirmed via grep on lines 52-53)
• because() message includes the new GHSA-jppx-w49h-x2qq advisory alongside all existing GHSA references (build.gradle lines 58-59)
• No other stray 4.2.15.Final netty references remain anywhere in the repo (verified via repo-wide grep across *.gradle files)

---

🔍 Braintrust trace