Play Framework

build: pin the Gradle distribution checksum

gradle-wrapper.properties had validateDistributionUrl=true but no
distributionSha256Sum, so the wrapper checked only that the URL pointed at
services.gradle.org — never that the 163MB it downloaded and executed was
the expected artifact. Same supply-chain reasoning renovate.json5 already
applies to third-party Actions via pinDigests.

Checksum from https://services.gradle.org/distributions/gradle-9.7.0-bin.zip.sha256
and independently corroborated: with the cache cleared, Gradle computed
84fbba45...d873ae from the freshly downloaded zip.

Verified the pin is load-bearing, not decorative — a deliberately wrong sum
against a cleared cache aborts with 'Verification of Gradle distribution
failed', exit 1; the correct sum re-downloads, validates and builds green.
Note Gradle skips verification entirely when the distribution is already
extracted, so the cache must be cleared to test this at all.

Renovate's gradle-wrapper manager updates this line alongside distributionUrl
now that it exists, so future wrapper bumps stay pinned.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>