[NopeCharon]

What

• Bumps nettyVersion from 4.2.9.Final to 4.2.17.Final, the Netty version io.grpc:grpc-netty:1.85.1 depends on. netty-transport-native-kqueue in grpc-netty-macos and grpc-netty-macos-aarch64 now matches the rest of Netty on their runtime classpath.

• Adds a verifyNettyVersions task to both macOS modules and wires it into check. It fails the build when any io.netty module on the runtime classpath resolves to a version other than nettyVersion:

  Netty modules on the runtime classpath of :java-spiffe-core:grpc-netty-macos do not match nettyVersion 4.2.9.Final:
  io.netty:netty-buffer:4.2.17.Final, ..., io.netty:netty-transport:4.2.17.Final.
  Set nettyVersion to the Netty version used by io.grpc:grpc-netty:1.85.1.
  

  It reads the resolved artifacts through a provider, so it doesn't access the project at execution time.

• Fixes the comment on nettyVersion. The macOS modules use the unshaded grpc-netty, not grpc-netty-shaded.

• Adds a changelog entry.

Fixes #505

Why

The build already said nettyVersion had to stay in sync with gRPC, but nothing checked it. Since Dependabot groups the io.grpc:* and io.netty:* updates (#403), every gRPC bump has been merged while nettyVersion stayed at 4.2.9. On main, the macOS modules (and the provider and helper on macOS) resolve netty-transport-native-kqueue and netty-transport-classes-kqueue 4.2.9.Final next to netty-transport and netty-transport-native-unix-common 4.2.17.Final, and the published POMs carry that mismatch to consumers. Netty supports native transports only at the same version as the rest of Netty.

With the check, a dependency update that moves gRPC's Netty without moving nettyVersion (or the other way round) fails CI with a message that says which version to set. This covers the Netty alignment concern in #106 for the modules that mix the two.

How tested

• ./gradlew :java-spiffe-core:grpc-netty-macos-aarch64:dependencies --configuration runtimeClasspath now shows netty-transport-native-kqueue and netty-transport-classes-kqueue at 4.2.17.Final, like every other Netty module.
• With nettyVersion set back to 4.2.9.Final, ./gradlew verifyNettyVersions fails for both modules with the message above. With 4.2.17.Final it passes, and --warning-mode all reports no deprecation from the new task.
• ./gradlew clean build on JDK 17 (Linux). The macOS-specific runtime path relies on the macOS CI job.