Remediate Log4Shell exposure by upgrading Log4j to 2.17.2

[Copilot]

This repository was still pinning Log4j 2.14.1, which is vulnerable to CVE-2021-44228-class issues in the Log4j 2.x line. This change upgrades the logging stack to a patched version and aligns Log4j modules on one fixed release.

• Dependency remediation

  • Introduced a single log4jVersion constant in build.gradle.kts.
  • Upgraded:
    • org.apache.logging.log4j:log4j-core → 2.17.2
    • org.apache.logging.log4j:log4j-api → 2.17.2

• Version alignment

  • Removed per-artifact version drift risk by resolving both Log4j artifacts from one shared version declaration.

• JNDI lookup surface check

  • No JNDI lookup usage (${jndi...}, JndiLookup, jndi:) is present in repository logging code/configuration.

dependencies {
    val log4jVersion = "2.17.2"

    implementation("org.apache.logging.log4j:log4j-core:$log4jVersion")
    implementation("org.apache.logging.log4j:log4j-api:$log4jVersion")
}