USPR-13772: bump io.netty minimum version to 4.2.16.Final for GHSA-hpcc-26xq-25fv

[midnight-clue]

Context & Problem

GitHub Security Alert (Dependabot #109) flags io.netty:netty-codec-http3 < 4.2.16.Final as vulnerable
to a HIGH severity memory exhaustion issue via HTTP/3 reserved frame types (GHSA-hpcc-26xq-25fv).
Dependabot could not auto-create a PR because the version is managed via a Gradle resolutionStrategy
override in the root build.gradle, not a direct dependency declaration.

USPR-13772

Solution

Bumped the io.netty minimum-version floor in the root build.gradle's
subprojects { configurations.configureEach { resolutionStrategy.eachDependency { ... } } } block from
4.2.15.Final to 4.2.16.Final, appending GHSA-hpcc-26xq-25fv to the existing because() message
while keeping all prior GHSA references. Also bumped the companion ext['netty.version'] overrides in
examples/example-spring-boot-starter-web/build.gradle and
examples/example-spring-boot-starter-webflux/build.gradle to stay in lockstep, following the same
pattern used for prior Netty/Jackson/Logback/Tomcat security bumps (see commit 850a009).

Verification

• Root build.gradleio.netty resolutionStrategy floor bumped to 4.2.16.Final with GHSA-hpcc-26xq-25fv appended to because() (manual diff review)
• Project builds and tests pass with the bumped Netty version (./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test)

🔍 Braintrust trace