build: align opensource dependency versions

[Gezi-lzq]

Summary

• align Netty modules in opensource release packaging so release artifacts no longer carry mixed Netty versions
• keep the legacy io.netty:netty alias untouched so Streams upgrade-system-tests that still depend on Netty 3.x continue to resolve
• unify protobuf-related versions by moving opensource modules to versions.protobuf and aligning proto-google-common-protos to the GCP BOM-compatible 2.40.0
• align SnakeYAML to 2.5 so opensource and enterprise resolve the same runtime version across Confluent, Jackson YAML, and Kubernetes client dependency chains
• bump software.amazon.s3tables:s3-tables-catalog-for-iceberg from 0.1.0 to 0.1.8
• exclude oshi's transitive slf4j-api to avoid duplicate SLF4J jars in release artifacts

Verification

• ./gradlew :core:compileJava :tools:compileJava :automq-metrics:compileJava
• ./gradlew -q :core:dependencyInsight --configuration runtimeClasspath --dependency org.yaml:snakeyaml
• ./gradlew -q :core:dependencyInsight --configuration runtimeClasspath --dependency com.google.api.grpc:proto-google-common-protos
• ./gradlew --build-cache rat checkstyleMain checkstyleTest spotlessJavaCheck