Make Kotlin subject to Dependabot updates

[k163377]

Problem

[versions] kotlin was not referenced by any catalog entry, so Dependabot could not resolve its coordinates and has never proposed an update for it. The existing ignore rules pointed at catalog aliases (kotlin, kotlin-metadata-jvm), which do not match Dependabot's dependency names either. Kotlin was not "ignored" — it was never detected in the first place.

Changes

• Reference versions.kotlin from the Kotlin library entries and add the Kotlin Gradle Plugin to [plugins], so that a single alias drives every Kotlin artifact.
• Move the KOTLIN_VERSION override into the version catalog (settings.gradle.kts). Adding version.ref breaks the previous "${libs.kotlin.stdlib.get()}:${kotlinVersion}" form, and overriding the alias keeps the declarations in build.gradle.kts plain.
• Replace the ineffective ignore rules with the same policy as Jackson: patch updates are accepted, minor/major updates are applied explicitly.
• Stop declaring kotlin-stdlib explicitly, following the official Kotlin libraries.

About kotlin-stdlib

kotlinx-coroutines, kotlinx-serialization, kotlinx-datetime, kotlinx-io and kotlinx.collections.immutable declare no kotlin-stdlib dependency and set no kotlin.stdlib.default.dependency; they leave it to the Kotlin Gradle Plugin. Their published POMs, along with those of kotlin-metadata-jvm and kotlin-reflect, all carry kotlin-stdlib at compile scope.

This project declared it explicitly via implementation, which published it at runtime scope. Removing the declaration aligns both the build script and the published POM with those libraries.

This changes the published artifact: kotlin-stdlib moves from runtime to compile scope.

Verification

Check	Result
./gradlew clean lintKotlin test	BUILD SUCCESSFUL
KOTLIN_VERSION=2.3.21 ./gradlew test	BUILD SUCCESSFUL
Kotlin Gradle Plugin resolution (default / 2.2.21 / 2.4.20-Beta1)	2.1.21 / 2.2.21 / 2.4.20-Beta1
POM (default)	kotlin-stdlib 2.1.21 / compile
POM (KOTLIN_VERSION=2.3.21)	kotlin-stdlib 2.3.21 / compile

kotlin-stdlib, kotlin-metadata-jvm, kotlin-reflect and kotlin-gradle-plugin all publish the same 2.1.x version set (2.1.0 2.1.10 2.1.20 2.1.21), so sharing a single version.ref cannot produce an unresolvable combination.

Note

The minimum Kotlin version in test-main.yml is still hardcoded as 2.1.21, so it needs to be kept in sync manually if Dependabot bumps [versions] kotlin.

🤖 Generated with Claude Code