chore(deps): security upgrade for dependencies

[0xbigapple]

What does this PR do?

Upgrade core dependencies to address known CVEs, and trim the dependency graph so that unused libraries no longer reach the build or downstream consumers. No public API or bytecode-level changes (JDK 8 target unchanged); this is a pure security/maintenance release.

Version upgrades

• Vert.x 4.5.21 → 4.5.27
• Netty 4.1.125.Final → 4.1.135.Final
• BouncyCastle bcprov-jdk18on:1.78.1 → 1.84
• gRPC 1.75.0 → 1.81.0 (protoc-gen-grpc-java kept at 1.60.0 per the existing CentOS 7 compatibility comment)

Netty dependency declaration refactor

• Replace io.netty:netty-all:4.1.125.Final with io.netty:netty-buffer:$nettyVersion — the only netty module trident uses directly. netty-all is a 44-module aggregator; dropping it removes dozens of unused codecs (mqtt, smtp, redis, …) from the dependency graph and the published POM.
• Align all transitive io.netty modules (from grpc-netty / vertx-core) to $nettyVersion via a resolutionStrategy.eachDependency rule (netty-tcnative-* excluded — separate versioning scheme). This replaces the previous per-module force("io.netty:netty-codec*:…") block.

Dependency graph trimming

• Exclude jackson-core from vertx-core: trident only uses io.vertx.core.buffer.Buffer and never vertx's JSON codec, so the transitive is dead weight. Jackson is now absent from every runtime classpath and from the published POM; abi keeps a test-only jackson-databind:2.18.9 for its own tests.
• Remove the unused shadow plugin: it is applied only to the root project (no sources, no dependencies), so shadowJar has always not used in the build, publish workflow or scripts consumes. Its four buildscript forces (commons-io, log4j-api/core, plexus-utils) existed solely to lift the plugin's vulnerable transitives and are removed with it.
• Drop the redundant okio force: grpc-okhttp 1.81.0 already requests okio 3.4.0, which contains the CVE-2023-3635 fix the force was added for; the resolved graph now tracks the versions gRPC tests against.

Housekeeping

• verification-metadata.xml: trust -sources/-javadoc jars and regenerate checksums for the new dependency graph (removed trees pruned).
• README: update the dependency snippet to the new versions.
• Version bump: 0.11.0 → 1.0.0.

Why are these changes required?

This PR has been tested by:

• Unit Tests

Follow up

Extra details