Gradle migration follow-ups (post-#326)

[pacmano1]

PR #326 migrated the build from Ant to Gradle with output verified byte-identical. To keep that PR reviewable and parity-checkable, several improvements were deliberately deferred. This issue tracks them. Parent: #52.

Build tooling

• Try Gradle 9. The wrapper ships on 8.14.1. Confirm the build runs clean under Gradle 9 and bump when it does. One known item to clear first: a Task.project-at-execution-time deprecation in verifyDistributionPlacement that Gradle 9 warns on and Gradle 10 removes. (raised by @jbeckers in Replace the Ant build with Gradle, output verified byte-identical #326)
• Consider the Kotlin DSL for the build scripts. Currently Groovy; Kotlin is Gradle's official recommendation. (raised in Replace the Ant build with Gradle, output verified byte-identical #326, agreed as a follow-up)
• Clean up stale .gitignore headers. ~111 inert commented section headers (# /client/src/com/...) date to the original 2017 .gitignore and still reference the pre-move layout. Update to src/main/java or drop them. (raised by @jbeckers in Replace the Ant build with Gradle, output verified byte-identical #326)

Dependencies

• Enable transitive dependency resolution. The migration intentionally pins a non-transitive, audited set matching the historical vendored jars. Move to normal transitive resolution one coordinate at a time, re-verifying each with the parity harness.
• CVE burn-down. An initial dependency-check baseline flagged ~54 distinct CVEs across ~46 jars. Start with the one-line, parity-checkable bumps (netty, jackson-databind, pdfbox), then the harder ones: Jetty 9.4.57 (EOL line), MyBatis ([SECURITY] Update MyBatis library #320), Derby, iText -> OpenPDF (Determine if itext is still used and remove it if it is not #289), commons-httpclient -> httpclient5. See also [SECURITY] 4.6.0 release notes should list fixed CVEs #304.
• Adopt byte-identical repackaged jars from Maven Central. 13 vendored jars are content-identical to Central artifacts (the HAPI 2.3 set, jtds, sqlite-jdbc, rsyntaxtextarea, autocomplete) and can be sourced from Central. The 3 genuine forks (javaparser 1.0.8, zip4j 1.3.3, not-going-to-be-commons-ssl) stay vendored.