USPR-13769: bump pinned Netty to 4.2.16.Final for GHSA-c69g-56f8-xwqj

[midnight-clue]

Context & Problem

GitHub Dependabot flagged a moderate-severity vulnerability (alert #112, GHSA-c69g-56f8-xwqj) in io.netty:netty-codec-http2: a lack of Host header deduplication in HTTP/2->HTTP/1.x translation can lead to request routing bypass. This affects Netty >= 4.2.0.Final and <= 4.2.15.Final, and is fixed in 4.2.16.Final. The repo currently pins Netty to 4.2.15.Final via a Gradle resolutionStrategy, one patch version below the fix. See USPR-13769.

Solution

Bump the pinned Netty version from 4.2.15.Final to 4.2.16.Final:

• Updated the io.netty resolutionStrategy.eachDependency check in the root build.gradle to enforce 4.2.16.Final, and extended the because() comment to reference GHSA-c69g-56f8-xwqj alongside the existing GHSA entries.
• Updated ext['netty.version'] in examples/example-spring-boot-starter-web/build.gradle and examples/example-spring-boot-starter-webflux/build.gradle to 4.2.16.Final to keep the examples consistent with the enforced version.

No other logic changes.

Verification

• Netty pinned to 4.2.16.Final, resolving GHSA-c69g-56f8-xwqj (root build.gradle resolutionStrategy + example modules' netty.version)
• Checkstyle/PMD/unit tests pass (./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test)

---

🔍 Braintrust trace