USPR-13771: bump forced netty version to 4.2.16.Final for GHSA-4mp9-239f-g9hg

[midnight-clue]

Context & Problem

GitHub Dependabot alert #110 flags io.netty:netty-codec-http versions 4.2.0.Final-4.2.15.Final as vulnerable to a WebSocket handshaker validation issue (GHSA-4mp9-239f-g9hg: WebSockets V07/V08 handshaker missing Connection/Upgrade header validation). The repo's existing resolutionStrategy.eachDependency override in build.gradle forced io.netty dependencies to 4.2.15.Final, which is itself the last vulnerable version in this range. See USPR-13771.

Solution

Bumped the existing io.netty version-forcing rule in build.gradle's subprojects{} block: the comparison threshold and useVersion call now target 4.2.16.Final instead of 4.2.15.Final, and the because(...) comment now also references GHSA-4mp9-239f-g9hg alongside the previously-listed GHSA IDs. This is a minimal, targeted change to the existing constraint, consistent with how prior GHSA fixes were applied to this same block — no new override or BOM bump was introduced.

Verification

• io.netty:netty-codec-http resolves to >= 4.2.16.Final (verified via ./gradlew :spring-boot-starter:spring-boot-starter-webflux:dependencies --configuration compileClasspath, confirmed resolved version 4.2.16.Final)
• Existing test suite passes (./gradlew test — BUILD SUCCESSFUL)

---

🔍 Braintrust trace