Remove use of version ranges in dependencies

[aalmiray]

There are so many reasons for NOT using version ranges that I don't know where to begin with, but at the very least

• build consistency
• reproducible artifacts

[jmanico]

Fixed by PR #373 from @strangelookingnerd, now merged to main. Version ranges are gone (commons-codec is pinned to 1.20.0) and the findbugs jsr305/annotations pair is replaced by spotbugs-annotations 4.9.8. Ships in the next release after 20260313.1. Thanks @aalmiray for raising it.