fix(deps): bump netty-handler 4.1.136 → 4.1.137 for CVE-2026-75595

CVE-2026-75595 is an SNI routing bypass in SslClientHelloHandler#decode
that lets a fragmented TLS ClientHello fall back to the default SslContext,
potentially bypassing per-SNI mTLS.  Fixed in netty 4.1.137.Final.

This resolves the CVE in server.jar and all plugin JARs
(awsLambda, dynamo, firestore, mysql).

Ref: GHSA-c4c3-7fpv-j4q5

Author: subrata71

app/server/pom.xml

@@ -45,8 +45,9 @@
         <mockito.version>4.4.0</mockito.version>
         <mockwebserver.version>5.0.0-alpha.2</mockwebserver.version>
         <!-- Pinned above the Spring Boot BOM default for CVE-2026-42583/42579/42584/42587/33870/33871/44249/45416/50010/45674/47691
-             and CVE-2026-55831/55833/55851/56745/56746/59898/59899/59900/59901/59919/59921 -->
-        <netty.version>4.1.136.Final</netty.version>
+             and CVE-2026-55831/55833/55851/56745/56746/59898/59899/59900/59901/59919/59921
+             and CVE-2026-75595 (SNI routing bypass via fragmented TLS ClientHello) -->
+        <netty.version>4.1.137.Final</netty.version>
         <okhttp3.version>4.12.0</okhttp3.version>
         <org.pf4j.version>3.15.0</org.pf4j.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>