Release 1.16.0

chore(deps): compile against Keycloak 26.7.4 (#18)

* chore(deps): compile against Keycloak 26.7.4

Supersedes #15, which bumped the same property to 26.7.0.

Part of closing CVE-2026-18963 (critical, unauthenticated account takeover via
the reset-credentials flow). The actual fix is the server image in tz-keycloak —
every org.keycloak artifact here is provided-scope, so this bump changes only
the compile target, not what runs. See tz-keycloak#43.

26.7.4 rather than 26.7.0: the 26.6.x image line ends at 26.6.4 (26.6.6 was
never published as a container image), so the server has to move to 26.7.x
regardless, and 26.7.4 is the current patch.

Builds clean, 83/83 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(release): 1.16.0

The jar is materially different from 1.15.0 even though no source changed —
it is now compiled against Keycloak 26.7.4 rather than 26.6.4 — so it needs
its own version. Pushing this to main cuts the 1.16.0 release the tz-keycloak
Dockerfile consumes.

Builds clean, 83/83 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>