chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped org.jetbrains.kotlin:kotlin-gradle-plugin from 2.1.20 to 2.4.20-Beta1 to resolve a medium severity vulnerability (unsafe deserialization in the Kotlin build cache enabling code execution, CVE-2026-53914 / GHSA-r937-wjx7-w2jp)
• Kept kotlin_version and kotlin_reflect_version in sync with the plugin version

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#57	org.jetbrains.kotlin:kotlin-gradle-plugin	medium	Bumped to 2.4.20-Beta1

Note: as of this PR, 2.4.20-Beta1 is the earliest version containing the fix; JetBrains has not yet published a stable 2.4.20 release (latest stable is 2.4.10). This only affects the Gradle build tooling/build-cache, not runtime code shipped in the SDK artifact.

Test plan

• ./gradlew :android-client-sdk:assembleDebug succeeds
• ./gradlew :android-client-sdk:testDebugUnitTest passes
• ./gradlew :android-client-sdk:lintDebug passes
• ./gradlew build succeeds for all modules (SDK + kotlin/java/openfeature examples); one intermittent timing-based test (DevCycleClientTests > variable calls back when variable value changes, uses CountDownLatch.await) failed once and passed on retries — confirmed pre-existing flake unrelated to this change (same flake documented in PR chore: resolve open dependabot security alerts #314)

[jonathannorris]

Closing: the only patched version for this alert (org.jetbrains.kotlin:kotlin-gradle-plugin 2.4.20-Beta1) is rejected by this repo's own CodeQL analysis (KotlinVersionTooRecentError: Kotlin version 2.4.20-Beta1 is too recent. CodeQL currently supports versions below 2.4.20), and no stable 2.4.20 release exists yet. Reverting the bump and closing this PR; alert #57 is unresolvable until JetBrains ships a stable 2.4.20+ release and/or GitHub's CodeQL Kotlin extractor adds support for it.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.