USPR-13805: bump spring-boot to 4.0.7 to patch spring-webmvc/spring-webflux path traversal (GHSA-72pg-x5f8-j25j)

[midnight-clue]

Context & Problem

Two Dependabot alerts (#121 for spring-webmvc, #122 for spring-webflux) flagged a
moderate-severity path traversal vulnerability, GHSA-72pg-x5f8-j25j, affecting Spring
Framework versions >= 7.0.0 and <= 7.0.7. Neither dependency is declared with an explicit
version in this repo — both are pulled in transitively via the Spring Boot BOM
(org.springframework.boot:spring-boot-dependencies), applied as a platform via
SpringBootPlugin.BOM_COORDINATES in the spring-boot-starter-web and
spring-boot-starter-webflux modules (and examples). The BOM version is controlled by the
single spring-boot entry in gradle/libs.versions.toml, previously pinned to 4.0.6.

USPR-13805

Solution

Bumped spring-boot in gradle/libs.versions.toml from 4.0.6 to 4.0.7 — the earliest
Spring Boot 4.0.x patch release whose managed Spring Framework version is >= 7.0.8 (confirmed
via Spring Boot's official release notes: 4.0.7 upgrades to Spring Framework 7.0.8). This is
the preferred fix per the ticket, since it resolves the vulnerability at the BOM level rather
than requiring an explicit spring-webmvc/spring-webflux version override in every consuming
module.

No changes were needed to the example modules' ext[...] overrides
(jackson-bom.version, jackson-2-bom.version, logback.version, netty.version,
tomcat.version) — Spring Boot 4.0.7 manages Jackson Bom 3.1.4, Logback 1.5.34, and Tomcat
11.0.22, all already matching the existing pins, and its managed Netty (4.2.15.Final) is still
below the repo's existing 4.2.16.Final floor (both the example ext['netty.version'] override
and the root build.gradle resolutionStrategy block), so that floor continues to win and
Netty resolution is unaffected by this change.

Verification

• org.springframework:spring-webmvc resolves to >= 7.0.8 (GHSA-72pg-x5f8-j25j patched)
  (verified: ./gradlew :spring-boot-starter:spring-boot-starter-web:dependencies --configuration testCompileClasspath and :examples:example-spring-boot-starter-web:dependencies --configuration compileClasspath both show org.springframework:spring-webmvc:7.0.8)
• org.springframework:spring-webflux resolves to >= 7.0.8 (GHSA-72pg-x5f8-j25j patched)
  (verified: ./gradlew :spring-boot-starter:spring-boot-starter-webflux:dependencies --configuration testCompileClasspath and :examples:example-spring-boot-starter-webflux:dependencies --configuration compileClasspath both show org.springframework:spring-webflux:7.0.8)
• No regressions: ./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test all pass
  (BUILD SUCCESSFUL, 92 tasks, no flaky test failures encountered)

---

🔍 Braintrust trace

[clue-gyg]

✅ Auto-approved as trivial change

Tiny 3-line change in gradle/libs.versions.toml that only bumps the spring-boot version pin from 4.0.6 to 4.0.7 (plus an explanatory comment) to patch a known CVE (GHSA-72pg-x5f8-j25j); no new dependencies added or removed, well under the 50-line limit, and qualifies as a version-only dependency manifest update.