fix: patch JVM dependencies and expand security checks

[hwisu]

The runtime-only OSV check missed recently announced Netty/Logback issues and vulnerable Apache HTTP libraries pulled in exclusively by Ktor's test host. Patch the affected dependencies and make CI cover both runtime and test runtime classpaths, with explicit security version floors for release advisories that have not reached OSV yet.

• Upgrade Netty to 4.2.19.Final and the AWS SDK's separate 4.1 line to 4.1.139.Final; upgrade Logback to 1.6.5 for CVE-2026-104721.
• Constrain Ktor's test HttpClient to 5.6.4 and its HttpCore transitives to 5.4.3, resolving GHSA-hjcp-jmpx-g3qm, GHSA-v3jc-474w-2wm6, and GHSA-hf6x-8p5f-cgmf.
• Refresh Gradle locks and verification metadata, including Linux and macOS native transport artifacts. Add seven regression tests for the version floors and audit behavior.

Validation: 157 JVM tests passed with Redis and S3 services, zero skipped; Kotlin 2.4.20 and 2.3.21 consumers passed; Provider v4 interop and Node/JVM SQLite, Redis, awareness, reconnect, and store-lock migration contracts passed. Lint, matrix/discovery, seven security tests, npm audit, and all 161 locked Maven runtime/test coordinates passed. Verified 75 new artifact checksums against Maven Central. Validation used the CI-pinned YKS revision 47095ae9a95e109f7cdc2ab411f766bf73484e16.

Security references: Netty release, Logback release.