Replace vendored jars with verified Maven Central dependencies

374 of 419 vendored jars are replaced by version-catalog coordinates
(gradle/libs.versions.toml). Every adopted coordinate was SHA-1-matched
byte-identical to the vendored jar it replaces; resolution is
non-transitive so the runtime artifact set stays exactly the audited
set, and gradle/verification-metadata.xml enforces sha256 on every
resolution. gradle/vendored-layout.json maps each artifact to its
historical place in the distribution; per-project placement checks
(aggregated by verifyVendoredParity, required by every build and by
setup assembly) fail if a resolved artifact lacks a placement. The 45
jars without a byte-identical published artifact stay vendored, each
with an evidence-based reason in
tools/build-parity/jar-provenance.json.

Distribution output is verified entry-content identical to an Ant
build of this branch's parent commit: 490 of 490 archives, zero
differences beyond tool metadata. Tooling and methodology in
tools/build-parity/.

Refs #52, #146

Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>

Author: pacmano1

CONTRIBUTING.md

@@ -53,6 +53,11 @@ dependencyCheck {
     nvd {
         apiKey = System.getenv('NVD_API_KEY') ?: ''
     }
+    // the distribution ships no .NET assemblies, and the analyzer
+    // hard-fails the whole scan on machines without a dotnet runtime
+    analyzers {
+        assemblyEnabled = false
+    }
     // also scan the jars that remain vendored (no Maven coordinates)
     scanSet = subprojects.collect { it.file('lib') }.findAll { it.directory }
 }