Play Framework

build(testrunner): move FirePhoque to HtmlUnit 5.6.0 and drop the Jetty 9.4 suppressions (PF-196)

play autotest's FirePhoque ran HtmlUnit 4.14.0, whose websocket client
shades Jetty 9.4.57. The release scan (PF-195) found CVE-2026-2332
there, request smuggling in Jetty's HTTP/1.1 parser, risk-accepted
until 2027-01-31 because no HtmlUnit 4.x shades a fixed Jetty (4.21.0
still has 9.4.58). Three more Jetty CVEs were suppressed because their
server code is not in the jar.

modules/testrunner/firephoque now holds HtmlUnit 5.6.0's runtime
dependencies, each checked against Maven Central's SHA-1:
- htmlunit, htmlunit-core-js, neko-htmlunit, htmlunit-cssparser,
  htmlunit-xpath, htmlunit-csp and htmlunit-websocket-client 5.6.0;
  the websocket client now shades Jetty 12.1.14;
- commons-lang3 3.21.0, commons-io 2.22.0 and commons-logging 1.4.0,
  the versions 5.6.0 declares;
- brotli's dec 0.1.2 goes, since 5.6.0 no longer depends on it;
- commons-codec 1.19.0 and httpclient/httpcore/httpmime stay as they
  were.
FirePhoque.java compiles against it unchanged.

The scan of every jar the release ships now reports nothing, the two
Jetty CVEs below the gate included, so the risk accept and the
code-absent entry are both removed. Section B of the suppressions file
is empty again.

`play autotest` passes on an application from `play new`: FirePhoque
drives /@tests through HtmlUnit 5.6.0 and writes result.passed. ant
test passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>