fix(deps): upgrade shadow plugin to resolve log4j-core XmlLayout vuln (COMP-1573)

The com.github.johnrengelman.shadow 8.1.1 build plugin transitively bundled
org.apache.logging.log4j:log4j-core 2.20.0 in the build tooling classpath, which
is affected by CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4 (XmlLayout fails to sanitize
characters forbidden by the XML 1.0 spec; fixed in log4j-core 2.25.4).

Migrate to the successor plugin com.gradleup.shadow 9.5.0, which ships
log4j-core 2.26.1 (>= 2.25.4). Shadow 9.x requires Gradle 9, so the Gradle
wrapper is bumped 8.13 -> 9.6.1 and the GraalVM native-build-tools plugin
0.10.6 -> 1.1.3 (first line to support Gradle 9). Verified: shadowJar builds
and all tests pass under Gradle 9.6.1.

See: https://github.com/seqeralabs/wave-cli/security/dependabot/16

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cristianrcv

app/build.gradle

@@ -1,8 +1,8 @@
 plugins {
     id 'groovy'
     id 'io.seqera.wave.cli.java-application-conventions'
-    id 'org.graalvm.buildtools.native' version '0.10.6'
-    id 'com.github.johnrengelman.shadow' version '8.1.1'
+    id 'org.graalvm.buildtools.native' version '1.1.3'
+    id 'com.gradleup.shadow' version '9.5.0'
 }
 
 java {

gradle/wrapper/gradle-wrapper.properties

@@ -17,7 +17,7 @@
 
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists