chore(deps): upgrade jsonrpc4j from 1.6 to 1.7

[waynercheung]

What does this PR do?

Upgrades com.github.briandilley.jsonrpc4j:jsonrpc4j from 1.6 to 1.7, the latest release.

• framework/build.gradle: bump jsonrpc4j to 1.7; add jakarta.servlet:jakarta.servlet-api:5.0.0 as a test-only dependency.
• build.gradle: remove javax.jws:javax.jws-api:1.1, which was only added as a workaround for jsonrpc4j's @WebParam lookup.
• gradle/verification-metadata.xml: regenerate the entries for the changed dependencies. This includes metadata-only entries: parent POMs, BOMs, and the Jackson 2.16.1 module files that jsonrpc4j 1.7 requests before conflict resolution selects 2.18.10.
• Tests: update JsonRpcDispatchContractTest for the new conversion error, and extend JsonRpcErrorSanitizationIntegrationTest, which runs a real JsonRpcServer behind JsonRpcServlet, with conversion-error cases.

No production Java code changes.

Why are these changes required?

1. Correct error code for parameter type mismatches. When a positional parameter cannot be converted to the declared Java type (for example an object or array where a string is expected), 1.6 returns -32700 "JSON parse error" with "id": "null". The request body is valid JSON, so -32700 is the wrong code, and the original id is lost. 1.7 returns -32602 with the request id preserved.
2. Drops the javax.jws workaround. 1.6 logs an error when javax.jws.WebParam is missing; 1.7 logs it at debug level. The explicit javax.jws-api dependency is no longer needed, and no code in the repository uses @WebParam.
3. Dependency hygiene. 1.7 replaces net.iharder:base64 with the JDK Base64 and pulls newer commons-codec and httpcore versions.

Wire-level change

This is the only response change we observed. It applies only to the parameter conversion failure described above:

	jsonrpc4j 1.6	jsonrpc4j 1.7
code	-32700	-32602
message	JSON parse error	Failed to read method parameter at index N
id	"null" (string)	request id preserved
data	absent	absent

• The same applies to batch entries; sibling entries are unaffected.
• Both versions respond to parameter-conversion failures without an id (1.6 with -32700 and id "null", 1.7 with -32602 and id null). This is an existing notification-handling defect; normalization remains deferred to [Feature]Standardize JSON-RPC error handling(revert codes, LiteNode pruned-history responses, request fields validation) #6676.
• The response echoes the request's jsonrpc value, as resolver-built errors already do; 1.6 always wrote "2.0" on this path.
• The error is built inside jsonrpc4j and does not pass through JsonRpcErrorResolver. Neither version logs it above DEBUG.
• The id follows jsonrpc4j's normal request-id parsing, as on other paths; existing limits, such as integer ids beyond the 64-bit range, are unchanged.

Other error paths (invalid JSON, arity mismatch, missing method, scalar params, execution errors) keep their current responses. The existing cases for these paths in JsonRpcServletTest, JsonRpcErrorSanitizationIntegrationTest and JsonRpcDispatchContractTest pass with both versions.

Classpath changes

Runtime (resolved framework runtimeClasspath, used to build FullNode.jar):

• jsonrpc4j 1.6 -> 1.7
• commons-codec 1.15 -> 1.16.1
• httpcore 4.4.13 -> 4.4.16
• httpcore-nio 4.4.5 -> 4.4.16
• jakarta.jws:jakarta.jws-api 3.0.0 added (transitive from jsonrpc4j)
• net.iharder:base64 and javax.jws:javax.jws-api removed
• slf4j-api and Jackson still resolve to 2.0.17 and 2.18.10

Test only:

• jakarta.servlet:jakarta.servlet-api 5.0.0. jsonrpc4j declares it optional, and Mockito needs it on the classpath to mock JsonRpcServer, which now has a jakarta handle overload. JsonRpcServlet dispatches through handleRequest and does not use that overload.

This PR has been tested by:

• Unit Tests
  • org.tron.core.services.jsonrpc.* and org.tron.core.jsonrpc.*: 346 tests pass, and checkstyleTest passes.
  • New JsonRpcErrorSanitizationIntegrationTest cases cover conversion errors in single and batch requests, with and without an id, through a real JsonRpcServer configured with the production error resolver. The id-less case uses the same helper as the existing notification-forwarding tests. All three new tests fail when jsonrpc4j is reverted to 1.6; the other cases in the class pass.
  • Full :framework:test run: 3396 tests completed, 43 failed, 26 skipped; the build retries a failed test up to 5 times.
    • 42 failures are 7 InetUtilTest cases, each failing on all 6 attempts with stack traces in DNS lookups. They fail the same way (42 failures) on the base commit in the same environment.
    • The other failure is the first attempt of BackupManagerTest.testInitSkipsDomainResolvingToLocalIp, which timed out after 5 seconds and passed on retry. This is consistent with slow host name resolution in this environment, where InetAddress.getLocalHost() takes about 5 seconds.
• Manual Testing
  • Built with an empty Gradle cache and an empty local Maven repository, so dependency verification checks every resolved artifact including parent POMs and BOMs.
  • Started a node and sent requests to the full node, solidity and PBFT JSON-RPC ports (8545/8555/8565):
    • conversion failures returned -32602, with the request id preserved in single and batch requests and id null for id-less requests;
    • no ERROR logs;
    • graceful shutdown.
  • Checked the built jar: no javax/jws, net/iharder or jakarta/servlet classes.

Follow up

• When Prometheus metrics are enabled, MetricInterceptor releases its timer only in postHandle, which jsonrpc4j calls only on the success path. Failed calls, including parameter-conversion failures and exceptions thrown by RPC methods, are not recorded in the latency metric, and the timer stays on the thread until a later request overwrites it. This happens with 1.6 as well and will be fixed separately.

Extra details

Upstream changes between 1.6 and 1.7 that do not affect this repository:

• The client-side JsonRpcFixedParam.
• The Spring exporter no longer extends RemoteExporter. We do not use the Spring exporter.
• hasReturnValue handling for void methods. No JSON-RPC method here returns void.

jsonrpc4j 1.7 targets Java 8 bytecode (class version 52).