fix: resolve dependabot security alerts

[jordeu]

Summary

Fixes all 6 open Dependabot alerts on the repository.

Alert	Dep	Was	Now	Path
#19/#18/#17	log4j-core	2.25.3	2.25.4	buildscript (yumi licenser)
#16 (high)	plexus-utils	4.0.2	4.0.3	buildscript (yumi licenser)
#14	jackson-core	2.18.0	2.18.6	runtimeClasspath (jersey)
#13	jgit	6.7.0	6.10.1	buildscript (yumi licenser)

Changes

• dev.yumi.gradle.licenser 3.0.1 → 4.0.0 — picks up jgit 6.10.1.
• Licenser moved from plugins {} to buildscript { dependencies { constraints { ... } } } so we can override its still-vulnerable transitives (log4j-core 2.25.3, plexus-utils 4.0.2). Once yumi 4.0.1+ ships with those bumps the buildscript block can be reverted to plain plugins { alias(libs.plugins.yumiLicenser) }.
• Jackson BOM 2.18.6 added as a platform on both implementation and testImplementation — aligns jackson-core/jackson-databind/jackson-annotations/jackson-module-jaxb-annotations to 2.18.6.
• Licenser 4.0.0 is stricter about files without a registered header handler (failed on .csv in src/test/resources). Added excludes for json, csv, txt, sh.

Verification

• ./gradlew buildEnvironment → buildscript classpath shows log4j-core 2.25.4, plexus-utils 4.0.3, jgit 6.10.1.
• ./gradlew :dependencyInsight --dependency jackson-core --configuration runtimeClasspath → 2.18.6 (by constraint).
• ./gradlew checkLicenses → passes (60 test files scanned).
• Full compileJava not run locally (PAT lacks read:packages scope for tower-java-sdk); CI will validate.

Test plan

• CI build passes
• CI unit tests pass
• Confirm Dependabot alerts close after merge / security-submit-dependencies workflow runs on master