fix(security): bump Spring Boot to 3.5.14 and Netty to 4.1.135 for CVE fixes (#41928)

## Summary

Remediates reachable High CVEs in the Spring server via two dependency
bumps.

| Change | Version | CVE(s) | Reachability |
|---|---|---|---|
| spring-boot-starter-parent | 3.5.12 → 3.5.14 | CVE-2026-40973
(insecure multipart temp file) | Affected — authenticated upload path |
| Netty (BOM override) | 4.1.131 → 4.1.135.Final | CVE-2026-33870,
CVE-2026-42583 | Affected — request-handling path behind Caddy |
| Netty (same bump, additional) | 4.1.131 → 4.1.135.Final |
CVE-2026-44249, 45416, 50010 (netty-handler); 45674, 47691
(netty-resolver-dns); 42584, 42587, 42579, 33871 (codec/http2/dns) |
Newly disclosed / not_affected — cleared for free |

### Why the Netty property override

Spring Boot 3.5.14's BOM manages Netty `4.1.132.Final`, which is still
vulnerable. `<netty.version>4.1.135.Final</netty.version>` is the
canonical property the `spring-boot-dependencies` BOM consumes, so it
bumps all `io.netty:*` artifacts consistently. There is no competing
`netty-bom` import or direct Netty pin in the server tree.

## Validation

- `mvn help:evaluate` confirms effective versions:
`netty.version=4.1.135.Final`, parent `3.5.14`.
- `appsmith-server` POM resolves/parses (BUILD SUCCESS).
- No hardcoded Netty pin elsewhere downgrades or bypasses the override.

## CI Trigger
/ok-to-test tags="@tag.All"

## Test plan
- [ ] CI green
- [ ] Server boots; an HTTP-backed plugin action executes (Netty/WebFlux
path)
- [ ] No dependency-convergence/enforcer breakage

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated the server platform to a newer Spring Boot release.
  * Centralized the Netty version used by the server build.
* Removed an outdated version-specific note from a plugin configuration
comment.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/28471068281>
> Commit: 9102e65
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28471068281&attempt=4"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.All`
> Spec:
> <hr>Wed, 01 Jul 2026 14:37:32 UTC
<!-- end of auto-generated comment: Cypress test results  -->

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sebastianiv21

app/server/appsmith-plugins/arangoDBPlugin/pom.xml

@@ -55,7 +55,7 @@
         </dependency>
 
         <!--
-            Netty 4.1.131 is shipped by the appsmith-server runtime via reactor-netty-http. arangodb-java-driver 7.x
+            Netty is shipped by the appsmith-server runtime via reactor-netty-http. arangodb-java-driver 7.x
             transitively pulls the same netty version through Vert.x WebClient. Declare these as 'provided' for the
             same reason as jackson above: avoid PluginClassLoader/parent-classloader collisions for io.netty.* classes.
         -->

app/server/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.12</version>
+        <version>3.5.14</version>
         <relativePath/>
         <!-- lookup parent from repository -->
     </parent>
@@ -37,6 +37,7 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <mockito.version>4.4.0</mockito.version>
         <mockwebserver.version>5.0.0-alpha.2</mockwebserver.version>
+        <netty.version>4.1.135.Final</netty.version>
         <okhttp3.version>4.12.0</okhttp3.version>
         <org.pf4j.version>3.15.0</org.pf4j.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>