USPR-13800: enforce patched Spring Expression version for GHSA-r5w3-xv2f-j59q

Add a resolutionStrategy override to root build.gradle forcing
org.springframework:spring-expression to 7.0.8 or higher, following the
existing pattern used for jackson/logback/tomcat/netty security floors.
Fixes Dependabot alert 128 (Spring Expression Language Algorithmic DoS).

Author: claude

build.gradle

@@ -58,6 +58,12 @@ subprojects {
                         'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
                         'after maxHeaderSize truncation, fixed in 4.2.16.Final')
             }
+            if (requested.group == 'org.springframework' && requested.name == 'spring-expression'
+                    && requested.version != null && requested.version < '7.0.8') {
+                useVersion('7.0.8')
+                because('GHSA-r5w3-xv2f-j59q: Spring Expression Language (SpEL) Algorithmic Denial of Service ' +
+                        'via crafted expressions causing excessive resource consumption, fixed in 7.0.8')
+            }
         }
     }