CHK-13035: Fix dependabot alert 31: upgrade logback to 1.5.25 (CVE-2026-1225)

[pboos]

Summary

• Upgrades ch.qos.logback:logback-core from 1.5.21 to 1.5.25 to fix CVE-2026-1225 (ACE vulnerability in logback configuration file processing)
• Logback is a transitive dependency via Spring Boot 4.0.0's BOM — Spring Boot hasn't released a version with the fix yet
• Uses both resolutionStrategy (for subprojects using platform(SpringBootPlugin.BOM_COORDINATES)) and ext['logback.version'] (for subprojects using io.spring.dependency-management plugin) to ensure all subprojects resolve to 1.5.25

Changes

• gradle/libs.versions.toml: Added logback = "1.5.25" version and library entries
• build.gradle: Added resolution strategy and ext property override in subprojects block

Verification

• All subprojects resolve logback-core to 1.5.25 (verified via ./gradlew dependencies)
• Compilation and tests pass (./gradlew compileJava compileTestJava test)

[pboos]

not needed as spring boot update fixed the dependabot issue