fix: pin safe Guava version in aggregate BOM

Pin Guava 33.7.2-jre and include it in the BOM consumer guard to remediate CVE-2026-102554.

Validation: reactor verification, core/full service smoke, packaged integration and exact-image scan passed; zero HIGH/CRITICAL findings. GHCR bootstrap, publication and visibility changes are outside this PR.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>

qqq-all-bom-test/pom.xml

@@ -51,6 +51,11 @@
    <!-- One versionless dependency per artifact the BOM manages, so resolving this -->
    <!-- module's test classpath resolves each of them. StackBomTest fails if one is missing. -->
    <dependencies>
+      <dependency>
+         <groupId>com.google.guava</groupId>
+         <artifactId>guava</artifactId>
+         <scope>test</scope>
+      </dependency>
       <!-- QQQ modules, qqq-esb, and qqq-frontend-next (from qqq-bom-pom) -->
       <dependency>
          <groupId>com.kingsrook.qqq</groupId>

qqq-all-bom/pom.xml

@@ -37,6 +37,7 @@
       <h2.version>2.4.240</h2.version>
       <artemis.version>2.57.0</artemis.version>
       <rabbitmq-jms.version>3.9.0</rabbitmq-jms.version>
+      <guava.version>33.7.2-jre</guava.version>
    </properties>
 
    <profiles>
@@ -79,6 +80,12 @@
 
    <dependencyManagement>
       <dependencies>
+         <!-- Keep authentication and Google clients on the fixed Guava runtime. -->
+         <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <version>${guava.version}</version>
+         </dependency>
          <!-- QQQ modules and qqq-esb. -->
          <dependency>
             <groupId>com.kingsrook.qqq</groupId>