fix: upgrade Netty to 4.1.129.Final to address security vulnerabilities

Force transitive Netty dependency upgrade to resolve:
- CVE-2025-24970 (HIGH 7.5): SslHandler validation flaw causing native crash
- CVE-2025-25193 (MEDIUM 5.5): DoS via null-byte in BoundedInputStream
- CVE-2025-55163 (HIGH 7.5): HTTP/2 "MadeYouReset" DDoS attack
- CVE-2025-58056 (HIGH 7.5): HTTP request smuggling via LF parsing
- CVE-2025-58057 (HIGH 7.5): BrotliDecoder DoS (zip bomb)
- CVE-2025-67735 (MEDIUM 6.5): CRLF injection / request smuggling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: git-wright

build.gradle

@@ -27,6 +27,12 @@ group = "com.pusher"
 version = "1.3.4"
 description = "Pusher HTTP Client"
 
+// Netty version override to address CVE-2025-24970, CVE-2025-25193, CVE-2025-55163,
+// CVE-2025-58056, CVE-2025-58057, CVE-2025-67735
+ext {
+    nettyVersion = '4.1.129.Final'
+}
+
 java {
     sourceCompatibility = JavaVersion.VERSION_11
     targetCompatibility = JavaVersion.VERSION_11
@@ -38,13 +44,26 @@ dependencies {
     implementation 'org.apache.httpcomponents:httpclient:4.5.13'
     implementation 'org.asynchttpclient:async-http-client:3.0.1'
     implementation 'com.google.code.gson:gson:2.8.9'
+
+    // Force Netty upgrade to resolve CVEs
+    implementation platform("io.netty:netty-bom:${nettyVersion}")
+
     testImplementation 'org.apache.httpcomponents:httpclient:4.5.13'
     testImplementation 'org.hamcrest:hamcrest-all:1.3'
     testImplementation 'org.jmock:jmock-junit5:2.12.0'
     testImplementation 'org.jmock:jmock-imposters:2.12.0'
     testImplementation 'org.junit.jupiter:junit-jupiter:5.7.1'
 }
 
+configurations.all {
+    resolutionStrategy.eachDependency { details ->
+        if (details.requested.group == 'io.netty') {
+            details.useVersion nettyVersion
+            details.because 'CVE-2025-24970, CVE-2025-25193, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-67735'
+        }
+    }
+}
+
 processResources {
     filter(ReplaceTokens, tokens: [
             version: project.version