implement dependabots findings

[riccardobl]

Implement, fix and validate dependabot findings at this link: https://github.com/jMonkeyEngine/jmonkeyengine/pulls/dependabot%5Bbot%5D

[jaime-jmebot]

Working through the four open Dependabot findings on this repository:

Finding	File	Change
PR #2955	gradle/libs.versions.toml	org.junit:junit-bom 5.13.4 → 6.1.3
PR #2956	gradle/libs.versions.toml	org.apache.groovy:groovy-test 4.0.31 → 5.1.0
PR #2957	jme3-nativeimage-plugin/build.gradle	org.graalvm.sdk:nativeimage 25.0.3 → 25.2.4 (org.graalvm.nativeimage:svm stays at 25.0.3 — upstream has no newer release, Dependabot's svm PR was closed as up to date)
PR #2933	.github/workflows/android-screenshot.yml	reactivecircus/android-emulator-runner v2.37.0 → v2.38.0

Planned fixes and validation: migrate the JUnit-3-style AppStateManagerTest.groovy (groovy.test.GroovyTestCase) to JUnit 5 Jupiter so it compiles against Groovy 5 and is actually discovered by useJUnitPlatform(), then compile and run the jme3-core test suite (which also builds the included jme3-nativeimage-plugin against nativeimage 25.2.4) plus a YAML lint of the modified workflow. A draft PR records the plan and the validated result; any incompatibility that requires touching an unrelated dependency will be reported here instead of being worked around.

[jaime-jmebot]

Implementation is up as PR #2960 (branch jaime/issue-2958-414d1ac8, still open for review).

Changes: junit-bom 5.13.4 → 6.1.3 (also the two hardcoded 5.9.1 pins in the screenshot-test modules), groovy-test 4.0.31 → 5.1.0, org.graalvm.sdk:nativeimage 25.0.3 → 25.2.4 (svm left at 25.0.3, as in the Dependabot PR), android-emulator-runner v2.37.0 → v2.38.0.

Fallout fixed: AppStateManagerTest.groovy migrated off the Groovy-5-removed groovy.test.GroovyTestCase to JUnit 5 Jupiter (its nested static JUnit-3 classes were also never discovered by useJUnitPlatform(), so the 8 cases now actually run), and common.gradle now compiles test sources — plus the screenshot-test framework modules, which use JUnit in their main code — with options.release = 17, because JUnit 6 ships Java 17 bytecode while the engine itself stays on Java 8.

Validation limit, reported rather than papered over: the sandbox has no network route to services.gradle.org, so the Gradle wrapper distribution cannot be fetched and no Gradle build or test run was possible there; the Android SDK is absent as well. What did run: TOML/YAML parsing, a full stale-version audit of the touched files, and migration checks (no GroovyTestCase reference left, 8 @Test, 4 assertThrows, JUnit confirmed in the :jme3-screenshot-tests:* main sources). Compile/test validation has to come from CI (BuildJMonkey, Checkstyle, ScreenshotTests, android-screenshot) or a local ./gradlew :jme3-core:test.

Two incompatibilities I deliberately did not work around, since they would require touching dependencies outside these findings: Mockito's mockito-junit-jupiter 5.23.0 under JUnit 6, and the nativeimage 25.2.4 / svm 25.0.3 mix. If CI flags either, it needs a decision here rather than a silent second bump.