USPR-13798: bump spring-boot to 4.0.7 to resolve Spring Framework multipart request smuggling (GHSA-cjpg-rgq5-fr37)

[midnight-clue]

Context & Problem

GitHub Security Alerts #130 and #131 flag a moderate-severity Multipart Request Smuggling vulnerability (GHSA-cjpg-rgq5-fr37) in Spring Framework's spring-webmvc and spring-webflux, both pulled in transitively via the Spring Boot BOM (previously 4.0.6) in this OpenAPI validation library. The vulnerable range is >= 7.0.0, <= 7.0.7; the patch is 7.0.8. See USPR-13798.

Solution

Bumped spring-boot in gradle/libs.versions.toml from 4.0.6 to 4.0.7. Spring Boot 4.0.7 manages Spring Framework 7.0.8 (the patched version), so both spring-webmvc and spring-webflux now resolve above the vulnerable range without needing a resolutionStrategy override. Neither package is a direct dependency with an explicit version literal in this repo — both come in transitively (test/testFixtures scope) via the Spring Boot BOM platform import, so no other files needed changes.

Verification

• org.springframework:spring-webmvc resolves to >= 7.0.8 (verified via ./gradlew :spring-boot-starter:spring-boot-starter-web:dependencyInsight --dependency spring-webmvc)
• org.springframework:spring-webflux resolves to >= 7.0.8 (verified via ./gradlew :test:openapi-webflux:dependencyInsight --dependency spring-webflux --configuration testFixturesCompileClasspath)
• ./gradlew help / ./gradlew tasks parse check passed

🔍 Braintrust trace

[clue-gyg]

✅ Auto-approved as trivial change

Single 2-line version bump in gradle/libs.versions.toml (spring-boot 4.0.6 → 4.0.7) — a version-field-only update with no new dependencies added or removed, analogous to the package.json version-bump exception, applied here to patch a known CVE (GHSA-cjpg-rgq5-fr37).