Play Framework

chore(deps): drop dom4j, jandex and cglib

Both audit passes agree, so the three jars carried as 'unverified' are gone.

Static (ant audit-deps): unreachable from framework/classes and from both bundled
modules' jars, and referenced by no other jar in framework/lib, framework/lib-test
or either module's lib. No source imports them, reflectively or otherwise.

Runtime (ant audit-census): never loaded in a run where Hibernate fully
bootstrapped against H2 -- 3,892 hibernate-core classes, 5,035 org.hibernate.*
loads, create-drop DDL and entity operations -- with ByteBuddy (2,193 classes)
performing the enhancement cglib once did. That matches upstream history:
Hibernate 5 replaced cglib with ByteBuddy, and Hibernate 6 dropped dom4j and made
Jandex optional in favour of hibernate-models, which does load here.

Confirmed by re-running the census after the removal: the same 94 jars supply
classes as before, and org.hibernate.* loads are unchanged at 5,033. The three
were contributing nothing to any classpath.

The residual risk is end-user applications, since framework/lib reaches their
classpath: an app loading an hbm.xml legacy mapping, supplying a Jandex index, or
using cglib directly must now declare it in its own build.gradle.kts. Nothing in
this repo, and nothing in jclaw, payments or api, references any of them.

The stale allowlist entries were caught by audit-deps itself -- STALE-ENTRY on
all three with file:line, failing the build until they were removed. dependencies-
audit.conf now has no 'unverified' entries left.

framework/lib is down to 133 jars, from 137 at the start of this audit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTvjeSmGVe7RFyx8ZJXRAx