Improved: Introduce a Gradle version catalog for dependency versions (OFBIZ-13487)

[mridulpathak]

Extracts dependencies.gradle's ~98 scattered dependency-version literals into a new
gradle/libs.versions.toml Gradle version catalog, with zero change in resolved
dependency versions -- verified via an empty before/after dependency-tree diff and a
full build + test run. Plugin-local dependencies (e.g. plugins/ldap) are untouched;
the catalog covers only core-framework/shared dependencies. settings.gradle is also
untouched: its two plugin versions can't use the catalog, since Gradle evaluates that
file's plugins {} block before any version catalog exists (gradle/gradle#24876,
closed not-planned).

[jacopoc]

Hi @mridulpathak

Did you check if, with the new format, Dependabot is still producing pull requests to keep the dependencies updated or if any configuration changes are required to our GitHub actions to allow it?
For example, I have noticed that Dependabot has recently created a few pull requests to bump Swagger in the rest-api component of the release branch (in which the component is under plugins, but this is irrelevant): see for example apache/ofbiz-plugins#355
However I don't see an equivalent pull request for the framework trunk.

[mridulpathak]

Hi @mridulpathak

Did you check if, with the new format, Dependabot is still producing pull requests to keep the dependencies updated or if any configuration changes are required to our GitHub actions to allow it? For example, I have noticed that Dependabot has recently created a few pull requests to bump Swagger in the rest-api component of the release branch (in which the component is under plugins, but this is irrelevant): see for example apache/ofbiz-plugins#355 However I don't see an equivalent pull request for the framework trunk.

Hi @jacopoc

I ran Dependabot manually for build.gradle and it produced two PRS #1610 and #1611 with the new setup as expected. I noticed there are a lot of failed PR generations from before due to GitHub's default limit of 5. Would it be wise to configure a higher limit in depandabot.yml? Also, all the open framework dependabot PRs are now stale with new changes, I'll go ahead and close them.