fix(parsers): finish Gradle verification comparisons

[mstykow]

Summary

• verify Gradle scorecard row 8 end to end with fresh compare-outputs runs for apache/kafka, elastic/elasticsearch, and gradle/gradle, and record the resulting snapshots in docs/BENCHMARKS.md
• fix two compare-discovered parser regressions: templated Maven pom.xml inputs no longer raise scan errors, and encrypted/protected PDF extraction failures degrade quietly instead of surfacing noisy file errors
• improve legacy setup.py recovery so open-based __init__.py version discovery and pinned dependency purls survive real-world fixtures such as Kafka's tests/setup.py

Issues

• Covers: Gradle verification scorecard row 8
• Closes:

Scope and exclusions

• Included:
  • Maven parser handling for templated pom.xml fixtures
  • PDF text-extraction suppression for encrypted/protected non-actionable failures
  • Python setup.py version and pinned dependency recovery
  • Gradle benchmark rows and scorecard status update
• Explicit exclusions:
  • no new parser/output golden fixture files
  • no changes to compare-output tooling itself

Intentional differences from Python

• None. The accepted remaining compare tails are ScanCode placeholder or normalization artifacts such as typo-level datasource differences, not intended Provenant behavior changes.

Follow-up work

• Created or intentionally deferred:
  • no new goldens; the new behavior is covered by focused parser and utility tests because there was no matching existing golden lane for the open-based setup.py version fallback or the encrypted-PDF suppression path

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: no .expected.json or golden YAML fixtures changed; correctness is evidenced by the targeted regression tests plus the final compare runs for gradle/gradle, elastic/elasticsearch, and apache/kafka