fix(deps): force org.springframework:spring-expression minimum version to 7.0.8 (GHSA-wxpp-56q6-5pcg)

Force spring-expression to >= 7.0.8 via root build.gradle resolutionStrategy override to fix Dependabot alert #123. spring-expression 7.0.0-7.0.7 are transitively pulled in via Spring Boot 4.0.6 BOM and are vulnerable to GHSA-wxpp-56q6-5pcg (Denial of Service via Unbounded Cache in SpEL). The fix is available in 7.0.8.

Co-Authored-By: Catarina Correia <catarina.correia@getyourguide.com>

Author: claude

build.gradle

@@ -58,6 +58,11 @@ subprojects {
                         'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
                         'after maxHeaderSize truncation, fixed in 4.2.16.Final')
             }
+            if (requested.group == 'org.springframework' && requested.name == 'spring-expression'
+                    && requested.version != null && requested.version < '7.0.8') {
+                useVersion('7.0.8')
+                because('GHSA-wxpp-56q6-5pcg: Spring Framework Denial of Service via Unbounded Cache in SpEL')
+            }
         }
     }