specify ubuntu image instead of "latest" (#3747)

<!-- Ensure the PR title reflects the feature or bug name -->

## What was the problem?
SecRel was failing, seemingly due to gradle 8.11 being pulled in by our
Github runner: `runs-on: ubuntu-latest` (see
https://github.com/actions/runner-images/blob/ubuntu22/20241112.1/images/ubuntu/Ubuntu2204-Readme.md#project-management).

## How does this fix it?[^1]
Specify ubuntu-22.04 since it pulls in gradle 8.10.2 instead (see
https://github.com/actions/runner-images/blob/ubuntu24/20241112.1/images/ubuntu/Ubuntu2204-Readme.md#project-management).


[^1]: [Pull-Requests
guidelines](https://github.com/department-of-veterans-affairs/abd-vro/wiki/Pull-Requests).
If PR is significant, update [Current Software
State](https://github.com/department-of-veterans-affairs/abd-vro/wiki/Current-Software-State)
wiki page.
[^secrel]: To check if a PR will succeed in the SecRel workflow, [test
PRs in the SecRel
pipeline](https://github.com/department-of-veterans-affairs/abd-vro-internal/wiki/Secure-Release-process#to-test-prs-in-the-secrel-pipeline).

.github/workflows/secrel.yml

@@ -106,7 +106,7 @@ jobs:
     outputs:
       vro-images: ${{ steps.publish-images.outputs.images_list }}
       slack-response-ts: ${{ fromJson(steps.notify-slack.outputs.slack-result).response.message.ts }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: "Determine image tag"
         id: image-props

gradle-plugins/build.gradle

@@ -18,7 +18,7 @@ dependencies {
     // Set versions for these plugins so we don't have to repeat the versions in convention.gradle files
     // https://discuss.gradle.org/t/applying-a-plugin-version-inside-a-convention-plugin/42160
     // Syntax: "<pluginName>:<pluginName>.gradle.plugin:<pluginVersion>"
-    implementation 'io.freefair.lombok:io.freefair.lombok.gradle.plugin:8.11'
+    implementation 'io.freefair.lombok:io.freefair.lombok.gradle.plugin:8.10.2'
     implementation 'com.diffplug.spotless:com.diffplug.spotless.gradle.plugin:6.24.0'
     implementation 'com.felipefzdz.gradle.shellcheck:com.felipefzdz.gradle.shellcheck.gradle.plugin:1.4.6'
     implementation 'com.palantir.docker:com.palantir.docker.gradle.plugin:0.35.0'

gradle-plugins/src/main/groovy/shared.java.vro-dep-constraints.gradle

@@ -48,7 +48,7 @@ dependencies {
         implementation 'ca.uhn.hapi.fhir:org.hl7.fhir.r4b:5.6.92'
         implementation 'ca.uhn.hapi.fhir:org.hl7.fhir.convertors:5.6.92'
 
-        implementation 'io.netty:netty-handler:4.1.100.Final'
+        implementation 'io.netty:netty-handler:4.1.105.Final'
 
         // For Kafka svc-bie-kafka service override
         implementation('org.xerial.snappy:snappy-java:1.1.10.4')

svc-bgs-api/src/Gemfile

@@ -8,7 +8,7 @@ gem 'bunny', '>= 2.13.0'
 gem 'activesupport', '~> 6.0'
 gem 'bgs_ext', git: 'https://github.com/department-of-veterans-affairs/bgs-ext.git', require: 'bgs'
 gem 'datadog_api_client', '>=2.23.0'
-gem 'rexml', '~> 3.3'
+gem 'rexml', '~> 3.3.9'
 gem 'async', '>= 2.17.0'
 
 group :development, :test do

svc-bgs-api/src/Gemfile.lock

@@ -145,7 +145,7 @@ DEPENDENCIES
   bunny (>= 2.13.0)
   cgi (~> 0.3.6)
   datadog_api_client (>= 2.23.0)
-  rexml (~> 3.3)
+  rexml (~> 3.3.9)
   rspec
 
 RUBY VERSION