Fix dependency vulnerabilities in buildscript classpath

Resolves vulnerable transitive dependencies on the plugin buildscript
classpath:

- Update the Shadow plugin from com.github.johnrengelman.shadow:8.1.1 to
  com.gradleup.shadow:8.3.6. This pulls plexus-utils up to 4.0.2,
  clearing alert 25 without a constraint. (Alert 25)

- Extend the existing buildscript constraints block to force patched
  versions of two libraries still pulled in transitively:
    org.apache.logging.log4j:log4j-core -> 2.25.4  (shadow + github-release)
    org.apache.tika:tika-core           -> 3.2.2   (github-release)

Resolves Dependabot alerts 21, 22, 25, 26, 27.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: bigdaz

gradle/libs.versions.toml

@@ -9,6 +9,8 @@ jackson-parameter-names = { group = "com.fasterxml.jackson.module", name = "jack
 jackson-kotlin = { group = "com.fasterxml.jackson.module", name = "jackson-module-kotlin" }
 
 apache-commons-io = { group = "commons-io", name = "commons-io", version = "2.21.0" }
+apache-tika-core = { group = "org.apache.tika", name = "tika-core", version = "3.2.2" }
+apache-log4j-core = { group = "org.apache.logging.log4j", name = "log4j-core", version = "2.25.4" }
 
 github-packageurl = { group = "com.github.package-url", name = "packageurl-java", version = "1.5.0" }
 okio = { group = "com.squareup.okio", name = "okio", version = "3.17.0" }
@@ -26,6 +28,6 @@ jetbrains-annotations = { group = "org.jetbrains", name = "annotations", version
 google-gson = { group = "com.google.code.gson", name = "gson", version = "2.13.2" }
 
 [plugins]
-shadow-jar = { id = "com.github.johnrengelman.shadow", version = "8.1.1"}
+shadow-jar = { id = "com.gradleup.shadow", version = "8.3.6"}
 plugin-publish = { id = "com.gradle.plugin-publish", version = "2.1.0" }
 github-release = { id = "com.github.breadmoirai.github-release", version = "2.5.2"}

plugin/build.gradle.kts

@@ -12,10 +12,13 @@ buildscript {
     }
     dependencies {
         constraints {
-            // The plugin com.github.breadmoirai.github-release:2.5.2 depends on vulnerable library releases.
+            // Several plugins on the buildscript classpath (com.github.breadmoirai.github-release:2.5.2,
+            // com.gradleup.shadow) depend on vulnerable library releases.
             // We constrain these to newer, patched versions.
             classpath(libs.okio)
             classpath(libs.apache.commons.io)
+            classpath(libs.apache.tika.core)
+            classpath(libs.apache.log4j.core)
         }
     }
 }