Bump Netty to 4.1.138.Final to address Dependabot alert

[Copilot]

This PR targets Dependabot alert #121. I couldn't read the alert from the sandbox, so I matched it to the dependency tree. The likely cause is Netty 4.1.137.Final, which comes in through azure-core-http-netty 1.16.7. Netty 4.1.138.Final fixes several advisories that affect 4.1.x up to 4.1.137: denial of service, header smuggling and memory leaks in the HTTP/1.1, HTTP/2 and SPDY codecs. Please check that the alert closes after merge.

Changes (pom.xml)

• azure-core-http-netty 1.16.7 → 1.16.8: this release is built on Netty 4.1.138.Final and netty-tcnative 2.0.84.Final.
• Import netty-bom 4.1.138.Final in dependencyManagement, next to jackson-bom. Without it, reactor-netty-http still pulls netty-codec-dns, netty-resolver-dns and the netty-resolver-dns-*-macos modules at 4.1.135.Final. The BOM keeps every io.netty artifact, including tcnative, on one patched version.

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-bom</artifactId>
    <version>${netty.bom.version}</version> <!-- 4.1.138.Final -->
    <type>pom</type>
    <scope>import</scope>
</dependency>

Resolved versions (runtime)

Artifact	Before	After
io.netty:* (core, codec-http/http2, handler, transport, …)	4.1.137.Final	4.1.138.Final
io.netty:netty-codec-dns, netty-resolver-dns*	4.1.135.Final	4.1.138.Final
io.netty:netty-tcnative-*	2.0.81.Final	2.0.84.Final
reactor-netty-http / reactor-netty-core	1.2.18	1.2.18 (unchanged)

Reviewer note

From now on, upgrading Netty means bumping netty.bom.version. The BOM overrides whatever version later azure-core-http-netty releases bring in, so it needs to be kept current.