Upgrade netty due to CVE-2024-47535

[ptrthomas]

we have received a report of security scans finding the netty dependency to be problematic. to quote:

Scan an OCI image containing the karate.jar, with for example trivy, and discover a 
high severity finding of CWE-400 by usage of io.netty:netty-common

link: GHSA-xq3w-v528-46rv

[ptrthomas]

upgrading armeria ensures that netty 4.1.115.Final is used which resolves the CVE cc @SkyHuk

karate 1.5.1 will be released soon (ETA to be determined), and can be expedited on request

note that teams should be able to over-ride dependencies without waiting for a release as explained here: #1834 (comment)

[ptrthomas]

1.5.1 released

[ptrthomas]

@SkyHuk - looks like in 1.5.1 another lib logback-core may be an issue though not high-sev, can you see if this is a problem when you get a chance, thanks !

[ptrthomas]

@SkyHuk - update, am making a quick 1.5.2 release for #2642

[SkyHuk]

@SkyHuk - looks like in 1.5.1 another lib logback-core may be an issue though not high-sev, can you see if this is a problem when you get a chance, thanks !

@ptrthomas - I checked on my end for 1.5.1 and I'm seeing the logback-core medium (1) and low (1) severity aswell. We are happy with the high-sev fix for now and will be looking forward for 1.5.2 when it releases 😄 👍

Thank you!