[Snyk] Security upgrade io.netty:netty-handler from 4.1.135.Final to 4.1.136.Final - #978

Remediates two CVEs flagged by the Confluent Hub security scan of v1.1.7:

- CVE-2026-59901 (HIGH): infinite loop in netty-codec's Bzip2Decoder RLE
  state machine, fixed in netty 4.1.136.Final
- CVE-2026-59949 (MEDIUM, CVSS 6.5): missing byte-array validation in
  lz4-java's JNI XXHash implementations, fixed in lz4-java 1.11.1

netty arrives transitively via java-driver-core 4.19.2.0, so it is forced
to 4.1.136.Final with a netty-bom import (Stage 1), the same workaround
used in scylladb#165 and scylladb#185. The upstream root fix is already merged
(scylladb/java-driver#978), but no driver release containing it has been
cut yet - the latest is 4.19.2.0, which still ships netty 4.1.135.Final.

lz4-java is a direct dependency here; 1.11.1 matches the version now on
the driver's scylla-4.x branch.

Once a driver release with #978 is available, bump scylladb.version and
drop the netty-bom override (Stage 3).

Closes scylladb#203
Supersedes: scylladb#201, scylladb#202 (lz4-java 1.11.0 -> 1.11.1 bot PRs - safe to close)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…VE-2026-59901 and CVE-2026-59949

- CVE-2026-59901 (HIGH): Bzip2Decoder can be driven into a permanent
  infinite loop in the RLE state machine of Bzip2BlockDecompressor.read(),
  capturing the event-loop thread. Fixed in netty 4.1.136.Final.

- CVE-2026-59949 (MEDIUM, CVSS 6.5): JNI-backed XXHash implementations do
  not validate their byte array arguments, so a null array or an
  out-of-range off/len can crash the JVM in GetPrimitiveArrayCritical.
  Fixed in lz4-java 1.11.1.

Both are patch-level bumps driven entirely by the root POM properties;
every netty/lz4 declaration already resolves through them. The driver's
LZ4 usage (LZ4Factory.fastestInstance(), fastCompressor(),
fastDecompressor()) does not touch the affected XXHash API, and netty
stays on the 4.1.x line the driver is built against.

The netty bump matches #978, which applied the same fix to scylla-4.x.

Tracked in: scylladb/scylla-cdc-source-connector#293

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Remediates two CVEs flagged by the Confluent Hub security scan of v1.1.7:

- CVE-2026-59901 (HIGH): infinite loop in netty-codec's Bzip2Decoder RLE
  state machine, fixed in netty 4.1.136.Final
- CVE-2026-59949 (MEDIUM, CVSS 6.5): missing byte-array validation in
  lz4-java's JNI XXHash implementations, fixed in lz4-java 1.11.1

netty arrives transitively via java-driver-core 4.19.2.0, so it is forced
to 4.1.136.Final with a netty-bom import (Stage 1), the same workaround
used in #165 and #185. The upstream root fix is already merged
(scylladb/java-driver#978), but no driver release containing it has been
cut yet - the latest is 4.19.2.0, which still ships netty 4.1.135.Final.

lz4-java is a direct dependency here; 1.11.1 matches the version now on
the driver's scylla-4.x branch.

Once a driver release with #978 is available, bump scylladb.version and
drop the netty-bom override (Stage 3).

Closes #203
Supersedes: #201, #202 (lz4-java 1.11.0 -> 1.11.1 bot PRs - safe to close)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>