USPR-13768: bump io.netty resolution override to 4.2.16.Final

[midnight-clue]

Context & Problem

GitHub Dependabot alert #113 flagged io.netty:netty-codec-compression (>= 4.2.0.Final, < 4.2.16.Final) for a high-severity infinite loop vulnerability in Bzip2Decoder's RLE state machine (GHSA-558v-64gr-wgg4) that can hang the Netty event-loop thread. The patched version is 4.2.16.Final. See USPR-13768.

Solution

Raised the existing centralized io.netty resolutionStrategy.eachDependency override in build.gradle (which already pins all io.netty group dependencies for prior CVEs) from 4.2.15.Final to 4.2.16.Final, and extended its because() message to reference GHSA-558v-64gr-wgg4 alongside the existing GHSA references. Also bumped the companion ext['netty.version'] pins in the two Spring Boot example modules (examples/example-spring-boot-starter-web and examples/example-spring-boot-starter-webflux) to keep their dependency-management BOM overrides in sync with the enforced version, following the same pattern established in the prior USPR-13707 fix. Verified settings.gradle and gradle/libs.versions.toml contain no other io.netty version pins that would need bumping.

Verification

• io.netty resolutionStrategy override in build.gradle bumped from 4.2.15.Final to 4.2.16.Final, with because() message updated to cite GHSA-558v-64gr-wgg4 (verified via diff)
• Companion netty.version pins in both example modules bumped to 4.2.16.Final for consistency (verified via diff)
• Confirmed no other io.netty pins exist in settings.gradle or gradle/libs.versions.toml (grep across build files)
• Gradle syntax check: ./gradlew help completed with BUILD SUCCESSFUL

🔍 Braintrust trace