fix(deps): force patched versions of vulnerable transitive deps

[jboileau99]

Description of this change

Adds resolutionStrategy.force directives in the root build.gradle to override 25 vulnerable transitive dependencies flagged by Dependabot. None of these dependencies are direct — they are pulled in transitively by build plugins (Dokka, AGP, gRPC) and do not ship in the SDK artifact. The forced versions resolve all open Dependabot alerts.

Vulnerabilities resolved

Alert #	Package	Old Version	New Version	Severity
61	io.netty:netty-codec-http2	4.1.110.Final	4.1.132.Final	high
60	io.netty:netty-codec-http	4.1.110.Final	4.1.132.Final	high
59	com.fasterxml.jackson.core:jackson-core	2.12.7	2.18.6	medium
58	ch.qos.logback:logback-core	< 1.5.25	1.5.25	low
57	org.apache.commons:commons-lang3	3.16.0	3.18.0	medium
56	org.apache.httpcomponents:httpclient	4.5.6	4.5.14	medium
55	org.bitbucket.b_c:jose4j	0.9.5	0.9.6	high
54	io.netty:netty-codec-http	4.1.110.Final	4.1.132.Final	medium
53	ch.qos.logback:logback-core	< 1.3.16	1.5.25	medium
51	org.jdom:jdom2	2.0.6	2.0.6.1	high
50	io.netty:netty-codec-http	4.1.110.Final	4.1.132.Final	low
49	io.netty:netty-codec	4.1.110.Final	4.1.132.Final	medium
48	io.netty:netty-codec-http2	4.1.123.Final	4.1.132.Final	high
47	io.netty:netty-handler	4.1.117.Final	4.1.132.Final	high
46	com.google.protobuf:protobuf-kotlin	3.24.4	3.25.5	high
44	com.fasterxml.jackson.core:jackson-core	2.12.7	2.18.6	high
43	com.fasterxml.jackson.core:jackson-core	2.12.7	2.18.6	medium
42	io.netty:netty-common	4.1.110.Final	4.1.132.Final	medium
41	io.netty:netty-common	4.1.114.Final	4.1.132.Final	medium
40	ch.qos.logback:logback-core	< 1.3.15	1.5.25	low
39	ch.qos.logback:logback-core	< 1.3.15	1.5.25	medium
36	com.google.protobuf:protobuf-java	3.24.4	3.25.5	high
32	io.netty:netty-codec-http	4.1.93.Final	4.1.132.Final	medium
23	io.netty:netty-codec-http2	4.1.93.Final	4.1.132.Final	high
18	io.netty:netty-handler	4.1.93.Final	4.1.132.Final	medium
10	com.fasterxml.woodstox:woodstox-core	6.2.4	6.7.0	medium

Why is this change being made?

• Chore (non-functional changes)
• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How was this tested? How can the reviewer verify your testing?

Verification results

Step	Result
./gradlew clean :ketchsdk:assembleDebug	PASS
./gradlew :ketchsdk:test	PASS
./gradlew :ketchsdk:lint	PASS (2 pre-existing warnings)
./gradlew :sample-app-standard:assembleDebug	PASS
./gradlew :sample-app-compose:assembleDebug	PASS
./gradlew :integration-tests:assembleDebug	PASS
./gradlew :integration-tests:connectedAndroidTest	SKIPPED (no emulator/device connected)

Dependency tree verified post-fix: all vulnerable transitive versions are correctly overridden to patched versions.

Related issues

Resolves 25 open Dependabot alerts: #10, #18, #23, #32, #36, #39, #40, #41, #42, #43, #44, #46, #47, #48, #49, #50, #51, #53, #54, #55, #56, #57, #58, #59, #60, #61

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have evaluated the security impact of this change, and OWASP Secure Coding Practices have been observed.
• I have informed stakeholders of my changes.