USPR-13773: force io.netty to >= 4.2.16.Final to fix CORS short-circuit security bypass

[midnight-clue]

Context & Problem

GitHub Dependabot flagged io.netty:netty-codec-http (< 4.2.16.Final) for GHSA-6cqp-g7gg-8hr5, a moderate-severity security control bypass via CORS short-circuit failure (Dependabot alert #108). Netty is a transitive dependency in this repo's dependency tree, and the root build.gradle already enforces a minimum Netty version via a resolutionStrategy.eachDependency override (previously 4.2.15.Final, addressing a prior batch of Netty GHSAs from USPR-13707). Jira: USPR-13773.

Solution

Raised the forced io.netty version threshold in the existing resolutionStrategy.eachDependency block (root build.gradle) from 4.2.15.Final to 4.2.16.Final, and extended the because() justification string with GHSA-6cqp-g7gg-8hr5. No new dependency-pinning mechanism was introduced since Netty is only a transitive dependency here; the existing override is the established pattern for this. The example projects' ext['netty.version'] = '4.2.15.Final' pins were left untouched since the root resolutionStrategy override applies across all subprojects and already forces any lower Netty version up to 4.2.16.Final.

Verification

• io.netty dependencies below 4.2.16.Final are forced to 4.2.16.Final (updated resolutionStrategy.eachDependency threshold and useVersion call in root build.gradle)
• GHSA-6cqp-g7gg-8hr5 documented in the because() justification string alongside the existing GHSA list

🔍 Braintrust trace

[clue-gyg]

✅ Auto-approved as trivial change

Trivial version-bump only change to build.gradle (~10 lines), raising the enforced minimum io.netty version from 4.2.15.Final to 4.2.16.Final to address a security vulnerability (GHSA-6cqp-g7gg-8hr5); no new dependencies added/removed, no API or behavior changes, consistent with the version-field-update exception for dependency manifests.