USPR-13806: bump spring-boot to 4.0.7 to fix spring framework dos vulnerability

[midnight-clue]

Context & Problem

GitHub Dependabot flagged a HIGH severity Denial of Service vulnerability (GHSA-x23c-287f-qqv5) in Spring Framework's handling of versioned resources in Spring MVC and WebFlux, affecting versions 7.0.0-7.0.7 (Dependabot alerts #119 and #120). The vulnerable org.springframework:spring-webmvc and org.springframework:spring-webflux jars are not declared directly in this repo — they are pulled in transitively via the Spring Boot Gradle plugin's dependency management (spring-boot = "4.0.6" in gradle/libs.versions.toml). See USPR-13806.

Solution

Bumped spring-boot from 4.0.6 to 4.0.7 in gradle/libs.versions.toml. Spring Boot 4.0.7 upgrades its managed Spring Framework version to 7.0.8 (the patched version — see Spring Boot 4.0.7 release notes: "Upgrade to Spring Framework 7.0.8"). This is a single-line, config-only fix: the repo has an existing convention for pinning transitive security fixes via resolutionStrategy.eachDependency overrides in root build.gradle (used for Jackson, Logback, Tomcat, Netty), but that pattern wasn't needed here since Spring Framework's version is fully controlled by the Spring Boot BOM. Confirmed the BOM bump doesn't conflict with any existing resolutionStrategy floors: Spring Boot 4.0.7 also upgrades to Logback 1.5.34 and Tomcat 11.0.22 (both exactly matching the existing floors), and Netty 4.2.15.Final (below the existing 4.2.16.Final floor, but the existing override already forces that up regardless of the BOM value).

Verification

• org.springframework:spring-webmvc resolves to >= 7.0.8 (./gradlew :spring-boot-starter:spring-boot-starter-web:dependencies --configuration compileClasspath shows org.springframework:spring-webmvc:7.0.8, up from 7.0.7)
• org.springframework:spring-webflux resolves to >= 7.0.8 (./gradlew :spring-boot-starter:spring-boot-starter-webflux:dependencies --configuration compileClasspath shows org.springframework:spring-webflux:7.0.8, up from 7.0.7)
• No regressions: ./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test passed (BUILD SUCCESSFUL, 92 tasks)

---

🔍 Braintrust trace

[clue-gyg]

✅ Auto-approved as trivial change

Single-line version bump in gradle/libs.versions.toml (spring-boot 4.0.6 -> 4.0.7) to patch a known DoS vulnerability; no new dependencies added/removed, well under size limit, matches the version-field-update exception for dependency manifests.