UID2-7251: bump netty to 4.1.135.Final to fix 4 HIGH CVEs

The Trivy scan in publish-azure-cc-enclave-docker (and all operator
publishes) fails on 4 HIGH netty CVEs in the operator jar:

  io.netty:netty-handler      CVE-2026-44249, CVE-2026-45416
  io.netty:netty-resolver-dns CVE-2026-45674, CVE-2026-47691

All four are fixed in netty 4.1.135.Final. The operator pins netty
directly via the netty.version property + netty-bom import, so it does
not inherit the version from uid2-shared; the bump must be made here.

uid2-shared PR #614 bumped netty to 4.1.133.Final, which is below the
4.1.135.Final fix version for these CVEs and so does not clear the scan.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: swibi-ttd

pom.xml

@@ -28,7 +28,7 @@
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
         <java.version>21</java.version>
-        <netty.version>4.1.133.Final</netty.version>
+        <netty.version>4.1.135.Final</netty.version>
     </properties>