fix: bump netty-handler to 4.1.137.Final for CVE-2026-62243

[heatherzh01]

Pin io.netty:netty-bom ahead of quarkus-bom so all Netty artifacts
resolve to 4.1.137.Final, which restores TLS hostname verification on
the SslProvider.OPENSSL client path. Keeps Quarkus at 3.36.2 to avoid
an unrelated platform bump.

[tmihalac]

Review note — traceability & future-upgrade risk of the netty pin

The netty-bom override has no inline comment tying it to CVE-2026-62243 or a removal condition. Because it is imported before the quarkus-bom, Maven's "first-declared import BOM wins" rule means this hardcoded 4.1.137.Final will override whatever netty a future Quarkus manages. Once Quarkus ships netty > 4.1.137 (potentially with newer CVE fixes), this pin will silently cap netty back to 4.1.137 and could re-expose the project, with nothing in the pom explaining why.

Suggestion: add an XML comment on the netty-bom block with (a) the CVE id, (b) a "temporary until Quarkus manages netty >= 4.1.137.Final" note, and (c) a tracking ticket, so it gets removed on the next Quarkus bump.

[tmihalac]

Review note — verify the native build before merge

The prod artifact is a Mandrel-25 native image (src/main/docker/Dockerfile.multi-stage), and quarkus-netty's native substitutions/registrations for Quarkus 3.36.2 were validated against netty 4.1.135.Final / tcnative 2.0.77.Final. This PR overrides netty core to 4.1.137.Final and, because the whole netty-bom is imported, also bumps netty-tcnative-classes 2.0.77.Final -> 2.0.81.Final. That is very likely compatible at the patch level, but this exact combination is untested by Quarkus and a native regression would not be caught by JVM tests.

Suggestion: run ./mvnw verify -Pnative (or the multi-stage Docker build) on this branch and confirm a green native build as a merge gate.

[heatherzh01]

traceability — Added an XML comment on the netty-bom block covering (a) CVE-2026-62243, (b) the removal condition (once quarkus.platform.version manages netty-handler >= 4.1.137.Final), and (c) the tracking ticket TC-6098.

native build — Ran a container-based native build on this branch