Play Framework

fix(deps): bump protobuf-java to >=3.25.5 for CVE-2024-7254 (PF-130)

Bump protobuf-java 3.23.4 -> 3.25.9 (latest stable 3.25.x patch; 3.25.5
is the first fixed release). 3.23.4 is vulnerable to CVE-2024-7254 and
ships on every consumer app's prod classpath as the opentelemetry-proto
peer for micrometer-registry-otlp. opentelemetry-proto stays at
1.2.0-alpha: its generated code targets protobuf-java 3.23.4, which the
3.25.x runtime is backward-compatible with, and transitiveDependencies
is off so this explicit pin governs.

framework/lib/ was re-resolved via `ant resolve -Dprune=true` (network
available): protobuf-java-3.23.4.jar pruned, protobuf-java-3.25.9.jar
added, no other jars changed. `ant compile` passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 79f6723895e515dca31bbfdab689341b7be70bbf)